SB20261109235 - Anolis OS update for python-virtualenv

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109235

SB20261109235 - Anolis OS update for python-virtualenv

Published: November 9, 2026

Security Bulletin ID SB20261109235
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Link following (CVE-ID: CVE-2026-113716)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged local attacker to place or replace environment files outside the selected destination using the invoking user's permissions.

The vulnerability exists due to virtualenv's builtin creator accepting existing directory symlinks when preparing a previously populated environment destination. A low-privileged local attacker can plant links beneath that destination before the user creates an environment, redirecting generated files into directories writable by the user but not necessarily the attacker.


Remediation

Install update from vendor's website.

References