{"id":"CVE-2026-113713","summary":"virtualenv: Temporary app-data can leave dangling seed package links","details":"virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.","aliases":["GHSA-4f8h-vr72-p32c"],"modified":"2026-10-21T10:45:18.478413572Z","published":"2026-10-20T19:06:25.880Z","database_specific":{"cwe_ids":["CWE-377"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113713.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113713.json"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/pull/3437"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.10"},{"type":"ADVISORY","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113713"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pypa/virtualenv","events":[{"introduced":"a795ab116356afde11039cf2763d77e8a06da738"},{"fixed":"236f395eba928d084d8d8fb6c3a7224555139056"},{"fixed":"b81995c3feab9e1edb453c75ffc6616e1a77335e"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"21.14.8"},{"fixed":"21.14.10"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"b81995c3feab9e1edb453c75ffc6616e1a77335e"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"21.14.10","range":[{"fixed":"236f395eba928d084d8d8fb6c3a7224555139056"}]}]}}],"versions":["21.14.9","21.14.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113713.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}]}