PyPI/virtualenv CVE-2026-113724: medium 4.5

virtualenv: Deletion recovery can change a symlink target's mode

Action: Upgrade virtualenv to 21.14.9 or later.

pip install virtualenv==21.14.9

Affected

Fixed versions

Sources

• osv: GHSA-43mp-35q3-x3fq
• https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq
• https://nvd.nist.gov/vuln/detail/CVE-2026-113724
• https://github.com/pypa/virtualenv/pull/3427
• https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440
• https://github.com/pypa/virtualenv
• https://github.com/pypa/virtualenv/releases/tag/21.14.9

CVE-2026-113724 · published 2026-10-21T21:31:34Z · modified 2026-10-21T21:45:08.336443737Z · JSON