CVE-2026-113720 pypa CVE debrief

Who should care

Defenders responsible for virtualenv environments, especially those with sensitive data or high-privilege access, should assess exposure and prioritize verification. This includes reviewing and updating virtualenv to version 21.14.9 or later, verifying permissions of files copied from app-data into new environments, and assessing the exposure of sensitive data or high-privilege access in virtualenv environments.

Why it matters

Defenders should assess exposure and prioritize verification of virtualenv environments, especially where sensitive data or high-privilege access is involved, due to the vulnerability in seeded file permissions.

• Defenders must verify permissions of files copied from app-data into new environments to prevent unintended access.
• Sensitive data or high-privilege access in virtualenv environments may be compromised if not properly configured.
• Remediation priority follows from verifying and updating virtualenv to version 21.14.9 or later.

Technical summary

The app-data copy seeder in virtualenv uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. This vulnerability affects the permissions of files copied from app-data into a new environment. The relevant source code is located in the copy helpers of virtualenv version 21.14.8. The default app-data seeder extracts a wheel into a reusable cache and copies its files into later environments with shutil.copy(). That function applies the cached source mode to each destination file after creating it.

Defensive priority

Defenders should assess exposure and prioritize verification of virtualenv environments, especially where sensitive data or high-privilege access is involved.

Recommended defensive actions

• Review and update virtualenv to version 21.14.9 or later
• Verify permissions of files copied from app-data into new environments
• Assess exposure of sensitive data or high-privilege access in virtualenv environments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in virtualenv, where seeded files retain permissions from an older cache. The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.