CVE-2026-113724 pypa CVE debrief

Who should care

Defenders and users of virtualenv, especially in environments where symbolic links are used, should assess exposure and prioritize remediation. This includes reviewing deployment contexts, verifying the use of symbolic links, and updating virtualenv to the latest version. Additionally, defenders should assess exposure and prioritize remediation for systems using virtualenv, especially in environments where symbolic links are used.

Why it matters

Defenders should assess exposure and prioritize remediation for systems using virtualenv, especially in environments where symbolic links are used.

• Change in permissions of symlink targets
• Potential security risks in environments with symbolic links

Technical summary

The safe_delete() function in virtualenv has an error handler that can change a symlink target's mode, potentially affecting users with specific deployment contexts. This occurs because the error handler obtains permission bits with lstat() but applies them through chmod(), following symlinks. As a result, a link inside a read-only directory can have its target's permissions changed. Defenders and users of virtualenv, especially in environments where symbolic links are used, should assess exposure and prioritize remediation. The issue is addressed in version 21.14.9 or later.

Defensive priority

Defenders should assess exposure and prioritize remediation for systems using virtualenv, especially in environments where symbolic links are used.

Recommended defensive actions

• Assess exposure and prioritize remediation for systems using virtualenv
• Verify if symbolic links are used in the environment
• Update virtualenv to version 21.14.9 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The issue arises from the safe_delete() function's error handler, which obtains permission bits with lstat() but applies them through chmod(), following symlinks. This can change permissions outside the destination.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.