---
id: CVE-2026-113713
title: 'virtualenv: Temporary app-data can leave dangling seed package links'
summary: >-
  virtualenv is a tool for creating isolated virtual python environments. From
  21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to
  temporary package files that virtualenv deletes when creation finishes. The
  envir…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-377
vendor: pypa
product: virtualenv
affected:
  - 'virtualenv >= 21.14.8, < 21.14.10'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T19:06:25.880Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113713'
references:
  - url: 'https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c'
    label: 'https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c'
  - url: 'https://github.com/pypa/virtualenv/pull/3437'
    label: 'https://github.com/pypa/virtualenv/pull/3437'
  - url: >-
      https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e
    label: >-
      https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e
  - url: 'https://github.com/pypa/virtualenv/releases/tag/21.14.10'
    label: 'https://github.com/pypa/virtualenv/releases/tag/21.14.10'
tags:
  - cve.org
ingestedAt: '2026-10-20T20:18:14.545Z'
---

## Overview

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.

## Affected

- `virtualenv >= 21.14.8, < 21.14.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.