CVE-2026-113713: Insecure Temporary File Symlink Handling in PyPA virtualenv

Vulnerability ID: CVE-2026-113713
CVSS Score: 4.4
Published: 2026-10-23

Insecure temporary file usage (CWE-377) in virtualenv app-data seeder creates dangling symlinks pointing to deleted temporary directories, allowing local attackers on shared systems to execute arbitrary code.

TL;DR

virtualenv versions 21.14.8 and 21.14.9 leave dangling symlinks when transient application data directories are deleted, enabling local code execution on shared systems.

Technical Details

• CVE ID: CVE-2026-113713
• Vulnerability Type: Insecure Temporary File (CWE-377)
• CVSS v4.0 Score: 4.4 (Medium)
• EPSS Score: 0.00107 (1.10th percentile)
• Affected Component: virtualenv app-data seeder (FromAppData)
• Impact: Local code execution via dangling symlink hijacking
• CISA KEV Status: Not Listed
• Fixed Version: 21.14.10

Affected Systems

• virtualenv
• virtualenv: >= 21.14.8, < 21.14.10 (Fixed in: 21.14.10)

Code Analysis

Commit: b81995c

copy seed packages because temporary app-data is removed after creation

class FromAppData(BaseEmbed):
    def __init__(self, options: VirtualEnvOptions) -> None:
        super().__init__(options)
-       self.symlinks = options.symlink_app_data
+       self.symlinks = options.symlink_app_data and not self.app_data.transient
+       if options.symlink_app_data and self.app_data.transient:
+           LOGGER.debug("copy seed packages because temporary app-data is removed after creation")

Mitigation Strategies

• Upgrade virtualenv package to version 21.14.10 or later.
• Disable VIRTUALENV_SYMLINK_APP_DATA in environment variables or virtualenv.ini on shared systems.
• Enforce sticky bits and private mount namespaces for /tmp directories in multi-user environments.

Remediation Steps:

1. Run pip install --upgrade virtualenv>=21.14.10 to install the fixed version.
2. Audit existing configuration files (virtualenv.ini) for symlink_app_data directives.
3. Re-create Python virtual environments generated by affected versions where transient app-data symlinking was active.

References

• GitHub Security Advisory GHSA-4f8h-vr72-p32c
• virtualenv Pull Request #3437
• virtualenv Fix Commit b81995c3feab9e1edb453c75ffc6616e1a77335e
• virtualenv Release 21.14.10
• NVD CVE-2026-113713 Detail
• CVE List CVE-2026-113713 JSON

Read the full report for CVE-2026-113713 on our website for more details including interactive diagrams and full exploit analysis.