CVE-2026-113721: Unsafe Link Resolution in virtualenv File Generation

Vulnerability ID: CVE-2026-113721

CVSS Score: 4.5

Published: 2026-10-22

In Python virtualenv prior to version 21.14.9, activation script generators and configuration writers use Path.exists() before writing files. Because Path.exists() resolves symbolic links, it returns False for dangling symlinks. Consequently, virtualenv skips unlinking pre-planted symbolic links or hard links, writing data directly to target locations outside the intended virtual environment directory.

TL;DR

virtualenv prior to 21.14.9 follows dangling symlinks during environment setup, allowing local attackers to write files outside the target directory.

Technical Details

CWE ID : CWE-59

Attack Vector : Local

CVSS Score : 4.5 (Medium)

EPSS Score : 0.00117 (1.57th percentile)

Impact : Arbitrary File Creation / Overwrite

Exploit Status : No Active Exploitation

CISA KEV Status : Not Listed

Affected Systems

virtualenv Python package (< 21.14.9)

virtualenv…