CVE-2026-113721

Name	CVE-2026-113721
Description	virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account that prepares final entries inside the destination can therefore cause environment creation to create or overwrite files outside the requested tree with constrained virtualenv-generated content and the invoking user's permissions. The destination parent must remain controlled by the environment owner during creation; concurrent parent-directory replacement is a separate concern. This issue is fixed in version 21.14.9.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151685

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-virtualenv (PTS)	bookworm	20.17.1+ds-1	vulnerable
	trixie	20.31.2+ds-1+deb13u1	vulnerable
	forky, sid	21.5.1+ds-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-virtualenv	source	(unstable)	(unfixed)			1151685

Notes

https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj
https://github.com/pypa/virtualenv/pull/3431
Fixed by: https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd (21.14.9)