CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113713?
CVE-2026-113713 is a medium-severity vulnerability in pypa virtualenv, published on 20 Oct 2026.
Official description
virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.
Weakness: CWE-377
Which versions are affected by CVE-2026-113713?
3 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | From 21.14.8 | 21.14.10 |
virtualenv PyPI | From 21.14.8 | 21.14.10 |
virtualenv PyPI | From 21.14.8 | 21.14.10 |
How do I fix CVE-2026-113713?
Upgrade virtualenv to 21.14.10 or later.
Is CVE-2026-113713 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113713 exists.
Sources
Also known as AZL-110103, BIT-virtualenv-2026-113713, DEBIAN-CVE-2026-113713, GHSA-4f8h-vr72-p32c, UBUNTU-CVE-2026-113713.