CVE-2026-113721: virtualenv: Generated files can follow existing destination links
Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly.
Anthropic’s OSS Scanner reported this as ANT-2026-XBEOCBS1 in virtualenv-20261015-005, received on 15 October 2026.
References
- github.com/advisories/GHSA-558c-9hv2-4prj
- github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd
- github.com/pypa/virtualenv/pull/3431
- github.com/pypa/virtualenv/releases/tag/21.14.9
- github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj
- nvd.nist.gov/vuln/detail/CVE-2026-113721
Code Behaviors & Features
Detect and mitigate CVE-2026-113721 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →