CVE-2026-113720: virtualenv app-data cache permission preservation vulnerability

CVE-2026-113720 · Severity: medium · CVSS 4 · Published 2026-10-20

virtualenv is a tool that creates isolated Python environments. Prior to version 21.14.9, it copies cached package files without properly applying the current system's permission restrictions, allowing files to become writable by other local user accounts. An attacker with a local account on the system could modify package code like pip/__init__.py and execute it when the environment owner runs Python, potentially leading to code execution or privilege escalation.

Technologies: Pypa Virtualenv, virtualenv (PyPI). Vendors: Pypa, PyPI.

Quick answers

Is CVE-2026-113720 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-113720 being exploited in the wild.
How severe is CVE-2026-113720?
Medium severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?
Pypa Virtualenv before 21.14.9; virtualenv (PyPI) < 21.14.9, ECOSYSTEM:introduced=0,fixed=21.14.9.
Is there a fix for CVE-2026-113720?
Yes. virtualenv (PyPI): upgrade to 21.14.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113720 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-113720?
Check whether you run Pypa Virtualenv or virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • virtualenv (PyPI): upgrade to 21.14.9 or later
    pip install "virtualenv>=21.14.9"

Technical details

The app-data copy seeder uses shutil.copy() to copy cached package files, which preserves the source file's permission bits even when they conflict with the current process's umask. A cache populated under a permissive umask can produce files writable by other local accounts in a later environment. The vulnerability requires a shared system with a pre-existing cache written under looser permissions; an attacker cannot force the earlier umask, and private destination parent directories prevent access. Fixed by applying current process umask at file creation time rather than preserving source permissions.

Affected products

  • pypa virtualenv before 21.14.9

Identifiers

  • CVE-2026-113720
  • GHSA-fc2g-4w5p-6whm

Timeline

  • 2026-10-20: disclosed
  • 2026-10-17: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.