CVE-2026-113724

Received Received - Intake

Symlink Race Condition in virtualenv

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can therefore cause a victim-owned target outside the destination that is initially not writable by the invoking user to become broadly writable before the retry fails, provided that user owns the target and can change its mode. Another account can use the widened mode only if it can traverse the target's parent directories; root does not reach the demonstrated failure path, and the operation does not itself read the target. This issue is fixed in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-22

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113724

EUVD

EUVD-2026-105272

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the virtualenv tool used for creating isolated Python environments. When deleting a symbolic link fails, the error handler incorrectly uses chmod() which follows the link and changes the target file's permissions to 0777, even though the deletion itself fails. This can make a previously read-only file writable by others if the user owns the target file.

Detection Guidance

Check if virtualenv version 21.14.8 is installed using pip show virtualenv. If installed, verify if symlinks in read-only directories are being used during virtualenv operations. Monitor for unexpected permission changes on files owned by users during deletion attempts.

Impact Analysis

An attacker could exploit this to make sensitive files like private keys writable by changing their permissions to 0777. This requires the attacker to plant a symlink in a read-only directory pointing to a file they own. The impact is limited as it requires specific conditions and user permissions.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized changes to file permissions. If exploited, it might lead to improper access to sensitive data (e.g., private key files) by widening permissions to 0777, violating confidentiality requirements. However, the attack requires specific conditions: user ownership of the target file, initial non-writable permissions, and traversal permissions on parent directories.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later using pip install --upgrade virtualenv. Avoid using virtualenv in directories with untrusted symlinks or read-only permissions until updated.

Hi! I’m here to help you understand CVE-2026-113724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70