CVE-2026-113713
Published:October 20, 2026
Updated:October 21, 2026
virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.
Affected Packages
virtualenv (CONDA):
Affected version(s) >=21.0.0 <21.14.10Fix Suggestion:
Update to version 21.14.10https://github.com/pypa/virtualenv.git (GITHUB):
Affected version(s) >=21.0.0 <21.14.10Fix Suggestion:
Update to version 21.14.10virtualenv (PYTHON):
Affected version(s) >=21.0.0 <21.14.10Fix Suggestion:
Update to version 21.14.10Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
4.4
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
HIGH
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.5
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
LOW
Weakness Type (CWE)
Insecure Temporary File