CVE-2026-113724: virtualenv Symlink Target Mode Change on Deletion Recovery
Summary
CVE-2026-113724: virtualenv: Deletion recovery can change a symlink target's mode. Affects virtualenv versions < 21.14.9. Fixed in 21.14.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
virtualenv is a popular Python package that allows users to create isolated Python environments, enabling them to manage dependencies for different projects without conflicts. It is widely used in the Python community for its simplicity and effectiveness in handling project-specific packages. However, a vulnerability has been identified in version 21.14.8 that affects the permission recovery process after a failed deletion, particularly when dealing with symbolic links.
Vulnerability Detail
The vulnerability arises from the way virtualenv's deletion error handler operates. When a deletion fails on a symbolic link, the handler retrieves permission bits using lstat() but applies them through chmod(), which follows symlinks. This can inadvertently change the permissions of the target file or directory, potentially exposing sensitive data. The issue is contingent upon the deletion failure occurring on a symlink and the user having permission to modify the target's mode. The vulnerability was reported by Anthropic's OSS Scanner and is classified as having a CVSS score of 4.5, indicating a moderate severity level.
How To Fix
Latest published version: 21.14.12 as of 22 Oct 2026
pip install --upgrade "virtualenv==21.14.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.14.9
This is the first release that contains the fix.
pip install --upgrade "virtualenv==21.14.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid recursively clearing destinations that are populated by another account. If a deletion fails, inspect the failing entry before retrying with broader privileges to prevent unintended permission changes.
Conclusion
The vulnerability CVE-2026-113724 in virtualenv poses a risk of unintended permission changes during deletion recovery processes. Users are advised to update to version 21.14.9 or later to mitigate this risk. Implementing the suggested workarounds can also help in managing the vulnerability until an update can be applied.
See every vulnerability recorded for virtualenv →
FAQ
CVE-2026-113724 is a vulnerability in the virtualenv package that can lead to unintended changes in file permissions when a deletion fails on a symbolic link.
If your application uses virtualenv version 21.14.8, it may inadvertently change the permissions of files or directories that are linked, potentially exposing sensitive information.
You can implement a workaround by avoiding recursive deletions in directories owned by other users and inspecting any failed deletions before retrying.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 4.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for virtualenv.
