CVE-2026-113713: virtualenv: Temporary app-data can leave dangling seed package links
The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation
finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though
the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its
owner no longer controls.
Anthropic’s OSS Scanner reported this as ANT-2026-ZOE2GEPC in virtualenv-20261015-005, received on 15 October 2026.
This draft records source review and functional remediation checks. The reporter’s cross-account code-execution claim
has not been independently reproduced.
References
- github.com/advisories/GHSA-4f8h-vr72-p32c
- github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e
- github.com/pypa/virtualenv/pull/3437
- github.com/pypa/virtualenv/releases/tag/21.14.10
- github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c
- nvd.nist.gov/vuln/detail/CVE-2026-113713
Code Behaviors & Features
Detect and mitigate CVE-2026-113713 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →