CVE-2026-113713: Insecure Temporary File Symlink Handling in PyPA virtualenv

Vulnerability ID: CVE-2026-113713

CVSS Score: 4.4

Published: 2026-10-23

Insecure temporary file usage (CWE-377) in virtualenv app-data seeder creates dangling symlinks pointing to deleted temporary directories, allowing local attackers on shared systems to execute arbitrary code.

TL;DR

virtualenv versions 21.14.8 and 21.14.9 leave dangling symlinks when transient application data directories are deleted, enabling local code execution on shared systems.

Technical Details

CVE ID : CVE-2026-113713

Vulnerability Type : Insecure Temporary File (CWE-377)

CVSS v4.0 Score : 4.4 (Medium)

EPSS Score : 0.00107 (1.10th percentile)

Affected Component : virtualenv app-data seeder (FromAppData)

Impact : Local code execution via dangling symlink hijacking

CISA KEV Status : Not Listed

Fixed Version : 21.14.10

Affected Systems

virtualenv

virtualenv : >= 21.14.8, < 21.14.10 (Fixed in: 21.14.10 )

Code Analysis

Commit: b81995c

copy…