Cloudanix VulnDB

CVE-2026-113720

None

CVSS

—

EPSS

0.1%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a Python environment tool could let one user on the same computer secretly change code inside another user's private Python setup, risking unauthorized changes or malware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Data Tampering
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The app-data copy seeder in virtualenv uses shutil.copy() on cached package files, preserving source file modes that were set under a prior permissive umask; this allows a later-created environment in a traversable directory to contain package files (such as pip/__init__.py) that are writable by other local accounts.

Why it matters to the business

Local users on the same system can modify Python package code inside another user's virtual environment, enabling unauthorized code execution and potential supply-chain tampering within isolated Python setups.

How an attack unfolds

An attacker first creates a virtualenv under a permissive umask to populate the app-data cache with world-writable package files; a victim later creates a new environment whose destination parent directory is traversable by the attacker, causing the cached files to be copied with the permissive modes intact so the attacker can modify executable package code.

How to fix it

Upgrade virtualenv to version 21.14.9 or later; after upgrade, recreate any environments created while vulnerable to ensure correct file permissions are applied.

How to confirm the fix worked

Confirm virtualenv version is 21.14.9 or newer; inspect newly created virtualenv package files for umask-compliant permissions (no world-writable bits) and verify cache directory contents are not reused from pre-upgrade runs.

Typical attack path

  1. Attacker runs virtualenv under permissive umask to seed cache
  2. Attacker identifies traversable directory used by victim for new environments
  3. Victim creates virtualenv that copies cached files preserving permissive modes
  4. Attacker modifies writable package file such as pip/__init__.py
  5. Victim activates environment and executes attacker-controlled code

How to detect it

Review file permission bits on package files inside virtualenvs (look for world-writable modes on files copied from app-data cache); examine process creation logs and file modification timestamps for virtualenv or pip operations occurring shortly after environment creation.

What your security team should do

  • Immediately upgrade all virtualenv installations to 21.14.9
  • Audit and recreate virtual environments created in the last six days
  • Enforce strict umask settings (such as 077) for users creating Python environments
  • Restrict directory permissions on common virtualenv parent paths to prevent traversal

The record

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities