CVE-2026-113720: virtualenv: Seeded files retain permissions from an older cache
The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments.
Anthropic’s OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026.
References
- github.com/advisories/GHSA-fc2g-4w5p-6whm
- github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1
- github.com/pypa/virtualenv/pull/3425
- github.com/pypa/virtualenv/releases/tag/21.14.9
- github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm
- nvd.nist.gov/vuln/detail/CVE-2026-113720
Code Behaviors & Features
Detect and mitigate CVE-2026-113720 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →