CVE-2026-113713

The record

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.

Affected packages

Related vulnerabilities

• CVE-2026-62847 Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. CWE-377
• CVE-2026-97209 Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user… CWE-377
• CVE-2026-93864 A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local… CWE-377
• CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-377
• CVE-2026-106451 yawkat LZ4 Java provides LZ4 compression for Java. CWE-377
• CVE-2026-47852 A local attacker on a multi-user host can pre-create the deterministic cache path and… CWE-377
• CVE-2026-63404 Faktory is a language-agnostic background job server. CWE-377
• CVE-2026-55086 Etherpad is a real-time collaborative editor. CWE-377