CVE-2026-113721 pypa CVE debrief

Who should care

Defenders who use virtualenv should care about this vulnerability, as it can potentially lead to security issues. Defenders should prioritize verifying and updating virtualenv to version 21.14.9 or later, and review their environments for potential exposure. This vulnerability can be exploited by an attacker who can prepare file links in the destination before creation. The invoking user must have write permission at the linked target. The destination

Why it matters

CVE-2026-113721 is a vulnerability in virtualenv that can potentially lead to security issues if not addressed. Defenders should prioritize verifying and updating virtualenv to version 21.14.9 or later, and review their environments for potential exposure.

• Verify and update virtualenv to version 21.14.9 or later to prevent potential security issues
• Review environments for potential exposure to ensure security

Technical summary

The vulnerability is related to the template writer and configuration writer in virtualenv, which can write outside the requested environment. The affected code is in the template writer and configuration writer. The vulnerability can potentially lead to security issues if not addressed. Defenders should prioritize verifying and updating virtualenv to version 21.14.9 or later, and review their environments for potential exposure. This vulnerability can be exploited by an attacker who can prepare file links in the destination before creation. The invoking user must have write permission at the linked target.

Defensive priority

Defenders should prioritize verifying and updating virtualenv to version 21.14.9 or later, and review their environments for potential exposure.

Recommended defensive actions

• Verify and update virtualenv to version 21.14.9 or later
• Review environments for potential exposure
• Monitor for suspicious activity related to virtualenv
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by Anthropic's OSS Scanner and is related to the template writer and configuration writer in virtualenv. The affected code is in the template writer and configuration writer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.