CVE-2026-113720: Local Permission Inheritance Vulnerability in virtualenv

Vulnerability ID: CVE-2026-113720
CVSS Score: 4.4
Published: 2026-10-23

virtualenv prior to version 21.14.9 contains a local permission inheritance vulnerability in its app-data copy seeder. Due to the reliance on Python's standard shutil.copy() function, permissions from cached packages are replicated directly onto newly created virtual environment files, ignoring the active process umask and allowing unprivileged local attackers to inject code.

TL;DR

virtualenv < 21.14.9 uses shutil.copy() when seeding environments from the app-data cache, preserving original file modes and bypassing process umask. If the cache was populated under a loose umask, resulting virtual environment files may remain world- or group-writable, allowing local privilege escalation via code injection.

Technical Details

• Vulnerability ID: CVE-2026-113720
• CWE ID: CWE-732 (Incorrect Permission Assignment for Critical Resource)
• CVSS v4.0 Score: 4.4 (Medium)
• CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
• Attack Vector: Local
• Exploit Status: No public weaponized exploit available
• CISA KEV Status: Not listed
• Patched Version: 21.14.9

Affected Systems

• virtualenv < 21.14.9
• virtualenv: < 21.14.9 (Fixed in: 21.14.9)

Code Analysis

Commit: 35f0b33

Fix copy seeding file permission replication by enforcing process umask and using explicit mode defaults in virtualenv util path sync.

Mitigation Strategies

• Upgrade virtualenv to version 21.14.9 or higher.
• Audit existing virtual environments created in multi-user or shared directories for permissive file modes.
• Avoid populating global app-data caches under permissive process umasks such as 000 or 002.

Remediation Steps:

1. Run 'pip install --upgrade virtualenv' to ensure virtualenv >= 21.14.9 is installed.
2. Identify existing vulnerable environments using 'find /path/to/venv -type f -perm -0002'.
3. Apply restrictive permissions using 'chmod 644' on standard environment files and 'chmod 755' on environment binaries.

References

• GitHub Security Advisory GHSA-fc2g-4w5p-6whm
• NIST NVD CVE-2026-113720 Detail
• CVE.org CVE-2026-113720 Record
• virtualenv Pull Request #3425
• virtualenv Commit 35f0b33562790176dd186d0a3c517af3acc7a0e1
• virtualenv Release 21.14.9

Read the full report for CVE-2026-113720 on our website for more details including interactive diagrams and full exploit analysis.