CVE-2011-4617: virtualenv Symlink Attack Vulnerability
Summary
CVE-2011-4617: virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/. Affects virtualenv versions < 1.5. Fixed in 1.5. How to fix ↓
Also tracked for
- python-virtualenv · Debian:11
The same CVE-2011-4617 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
virtualenv is a tool used to create isolated Python environments. It allows users to install Python packages without interfering with the system-wide Python installation. By creating a virtual environment, users can have separate Python environments for different projects, each with its own set of dependencies. This vulnerability affects virtualenv versions prior to 1.5.
Vulnerability Detail
The vulnerability (CVE-2011-4617) in virtualenv before version 1.5 allows local users to overwrite arbitrary files through a symlink attack on a specific file in the /tmp/ directory. This means that an attacker with local access to the system can manipulate symbolic links to overwrite files that they should not have access to. By exploiting this vulnerability, an attacker could potentially gain unauthorized access, modify sensitive data, or disrupt the normal operation of the affected system.
How To Fix
Latest published version: 21.14.12 as of 22 Oct 2026
pip install --upgrade "virtualenv==21.14.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5
This is the first release that contains the fix.
pip install --upgrade "virtualenv==1.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of virtualenv is not immediately possible, users can implement the following workaround to mitigate the risk of symlink attacks:
- Avoid creating virtual environments in the /tmp/ directory.
- Choose a different directory for creating virtual environments, preferably in a location with restricted access.
- Regularly monitor and clean up the /tmp/ directory to remove any potential symlink vulnerabilities.
Conclusion
The virtualenv symlink attack vulnerability (CVE-2011-4617) poses a risk to systems running virtualenv versions prior to 1.5. By exploiting this vulnerability, an attacker with local access to the system can overwrite arbitrary files through symlink attacks. To mitigate this risk, it is recommended to upgrade virtualenv to version 1.5 or later. Alternatively, users can follow the provided workaround to minimize the risk of symlink attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for virtualenv →
FAQ
virtualenv is a tool used to create isolated Python environments. It allows users to install Python packages without interfering with the system-wide Python installation.
A symlink attack, also known as a symbolic link attack, is a type of security vulnerability where an attacker manipulates symbolic links to gain unauthorized access or overwrite files that they should not have access to.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your virtualenv installation is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including this virtualenv symlink attack vulnerability.
There are no known public exploits of this vulnerability at the time of this report. However, it is important to promptly update virtualenv to the latest version to mitigate the risk of potential attacks.
No, this vulnerability requires local access to the system to exploit. Remote exploitation is not possible.
Related vulnerabilities
Recent vulnerabilities recorded for virtualenv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
