CVE-2026-113716: virtualenv: Builtin creation follows linked environment directories
The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination.
Anthropic’s OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15 October 2026.
References
- github.com/advisories/GHSA-cw65-gx24-rc82
- github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5
- github.com/pypa/virtualenv/pull/3429
- github.com/pypa/virtualenv/releases/tag/21.14.9
- github.com/pypa/virtualenv/security/advisories/GHSA-cw65-gx24-rc82
- nvd.nist.gov/vuln/detail/CVE-2026-113716
Code Behaviors & Features
Detect and mitigate CVE-2026-113716 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →