CVE-2026-113713 pypa CVE debrief

Who should care

Defenders managing virtualenv environments, especially those using symlink seeding or shared temporary-directory parents, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify if their virtualenv environments are vulnerable to dangling seed package links and take appropriate actions.

Why it matters

CVE-2026-113713 involves a security concern with virtualenv's app-data seeder, which can leave environments linked to temporary package files. This issue requires verification of exposure, especially in shared temporary-directory parent scenarios, and remediation through version updates.

• Defenders must verify if their virtualenv environments are vulnerable to dangling seed package links.
• Remediation requires updating to version 21.14.10 or later.
• Exposure could lead to integrity issues with app-data references after temporary cache cleanup.
• Defenders should monitor cache pathname changes for potential dangling references.

Technical summary

The app-data seeder in virtualenv can leave environments linked to temporary package files that are deleted when creation finishes. This issue arises when symlink seeding is enabled via VIRTUALENV_SYMLINK_APP_DATA or symlink_app_data in configuration files, and app-data setup falls back to a temporary directory. Affected versions include 21.14.8 and 21.14.9; version 21.14.10 fixes the issue. The vulnerability requires verification of exposure, especially in shared temporary-directory parent scenarios, and remediation through version updates. Defenders should assess exposure and prioritize remediation for virtualenv environments where symlink seeding is enabled.

Defensive priority

Defenders should assess exposure and prioritize remediation for virtualenv environments where symlink seeding is enabled, especially in shared temporary-directory parent scenarios.

Recommended defensive actions

• Assess virtualenv environments for symlink seeding enabled via VIRTUALENV_SYMLINK_APP_DATA or configuration files.
• Verify app-data setup falls back to temporary directories in shared parent locations.
• Remediate by updating to version 21.14.10 or later.
• Monitor for cache pathname changes and potential dangling references.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. This occurs when symlink seeding is enabled through VIRTUALENV_SYMLINK_APP_DATA or symlink_app_data in the configuration file, and app-data setup falls back to a temporary directory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.