{"action":"Upgrade virtualenv to 21.14.9 or later.","affected":[{"fixed":"21.14.9","introduced":"0"}],"component":"virtualenv","cve_ids":["CVE-2026-113724"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["21.14.9"],"ghsa_id":"GHSA-43mp-35q3-x3fq","id":"tcs_01M5JMBVQMQRBR32QKH99RY1Q3","modified_at":"2026-10-21T21:45:08.336443737Z","published_at":"2026-10-21T21:31:34Z","references":["https://osv.dev/vulnerability/GHSA-43mp-35q3-x3fq","https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq","https://nvd.nist.gov/vuln/detail/CVE-2026-113724","https://github.com/pypa/virtualenv/pull/3427","https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440","https://github.com/pypa/virtualenv","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"severity":{"label":"medium","score":4.5},"sources":[{"source":"osv","source_id":"GHSA-43mp-35q3-x3fq","url":"https://osv.dev/vulnerability/GHSA-43mp-35q3-x3fq"}],"summary":"virtualenv: Deletion recovery can change a symlink target's mode"}