CVE-2026-113721: Unsafe Link Resolution in virtualenv File Generation

Vulnerability ID: CVE-2026-113721
CVSS Score: 4.5
Published: 2026-10-22

In Python virtualenv prior to version 21.14.9, activation script generators and configuration writers use Path.exists() before writing files. Because Path.exists() resolves symbolic links, it returns False for dangling symlinks. Consequently, virtualenv skips unlinking pre-planted symbolic links or hard links, writing data directly to target locations outside the intended virtual environment directory.

TL;DR

virtualenv prior to 21.14.9 follows dangling symlinks during environment setup, allowing local attackers to write files outside the target directory.

Technical Details

• CWE ID: CWE-59
• Attack Vector: Local
• CVSS Score: 4.5 (Medium)
• EPSS Score: 0.00117 (1.57th percentile)
• Impact: Arbitrary File Creation / Overwrite
• Exploit Status: No Active Exploitation
• CISA KEV Status: Not Listed

Affected Systems

• virtualenv Python package (< 21.14.9)
• virtualenv: < 21.14.9 (Fixed in: 21.14.9)

Code Analysis

Commit: d25f286

Fix unsafe link resolution in virtualenv template and configuration writers

Mitigation Strategies

• Upgrade virtualenv package to version 21.14.9 or later.
• Enforce strict directory permissions (chmod 700) on temporary build folders.
• Avoid creating virtual environments in shared or world-writable directories.

Remediation Steps:

1. Upgrade virtualenv across all build environments using pip install --upgrade virtualenv>=21.14.9.
2. Audit automated scripts and CI/CD pipelines to ensure target directory isolation.
3. Verify that non-privileged users cannot modify destination environment paths before execution.

References

• GitHub Security Advisory GHSA-558c-9hv2-4prj
• Pull Request #3431: Safe File Generation
• Fix Commit d25f28699eefb1fc34a251e5adf2b5de844c36cd
• virtualenv Release 21.14.9
• NVD Vulnerability Detail CVE-2026-113721
• CVE Record CVE-2026-113721

Read the full report for CVE-2026-113721 on our website for more details including interactive diagrams and full exploit analysis.