Link following in py3-virtualenv - CVE-2026-113716

Vulnerability details

The vulnerability allows a low-privileged local attacker to place or replace environment files outside the selected destination using the invoking user's permissions.

The vulnerability exists due to virtualenv's builtin creator accepting existing directory symlinks when preparing a previously populated environment destination. A low-privileged local attacker can plant links beneath that destination before the user creates an environment, redirecting generated files into directories writable by the user but not necessarily the attacker.

Affected software

How to mitigate CVE-2026-113716

External References

• https://github.com/pypa/virtualenv/security/advisories/GHSA-cw65-gx24-rc82

Related Security Bulletins

• Multiple vulnerabilities in py3-virtualenv
• Anolis OS update for python-virtualenv