{"id":"CVE-2026-113713","title":"virtualenv: Temporary app-data can leave dangling seed package links","summary":"virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The envir…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-377"],"vendor":"pypa","product":"virtualenv","affected":["virtualenv >= 21.14.8, < 21.14.10"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T19:06:25.880Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113713","references":[{"url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c","label":"https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c"},{"url":"https://github.com/pypa/virtualenv/pull/3437","label":"https://github.com/pypa/virtualenv/pull/3437"},{"url":"https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e","label":"https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e"},{"url":"https://github.com/pypa/virtualenv/releases/tag/21.14.10","label":"https://github.com/pypa/virtualenv/releases/tag/21.14.10"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T20:18:14.545Z","slug":"CVE-2026-113713","body":"## Overview\n\nvirtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.\n\n## Affected\n\n- `virtualenv >= 21.14.8, < 21.14.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}