CVE-2026-113724: virtualenv: Deletion recovery can change a symlink target's mode
The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows symlinks. On an eligible unlink failure this can change permissions outside the destination.
Anthropic’s OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005, received on 15 October 2026.
References
- github.com/advisories/GHSA-43mp-35q3-x3fq
- github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440
- github.com/pypa/virtualenv/pull/3427
- github.com/pypa/virtualenv/releases/tag/21.14.9
- github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq
- nvd.nist.gov/vuln/detail/CVE-2026-113724
Code Behaviors & Features
Detect and mitigate CVE-2026-113724 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →