CVE-2026-113720 virtualenv: Seeded files retain permissions from an older cache
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113720?
CVE-2026-113720 is a medium-severity vulnerability in pypa virtualenv, published on 20 Oct 2026.
Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.
Weakness: CWE-732
Which versions are affected by CVE-2026-113720?
3 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | All versions | 21.14.9 |
virtualenv PyPI | All versions | 21.14.9 |
virtualenv PyPI | All versions | 21.14.9 |
How do I fix CVE-2026-113720?
Upgrade virtualenv to 21.14.9 or later.
Is CVE-2026-113720 being exploited?
There is no known exploitation of CVE-2026-113720 in the wild and no public exploit code.
Sources
Also known as AZL-110118, BIT-virtualenv-2026-113720, DEBIAN-CVE-2026-113720, ECHO-3ebe-71af-e577, GHSA-fc2g-4w5p-6whm, MINI-39m6-qp4h-6pcr and 1 more.