Read the docs
TI-2026-77003 Aliases CVE-2026-113713GHSA-4f8h-vr72-p32c

Temporary app-data leaves dangling links in virtualenv environments

Priority MEDIUM 54CWE-377Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

virtualenv from 21.14.8 before 21.14.10 can leave an environment linked to temporary package files that virtualenv deletes when creation finishes (CWE-377). The environment-variable and configuration-file forms of symlink_app_data can create this state even when the command-line flag is disabled for temporary app-data. A local user with low privileges can tamper with the affected environment because it depends on a cache path that its owner no longer controls.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Partial virtualenv (pypa): 21.14.10virtualenv (PyPI): 21.14.10Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pypavirtualenv21.14.8 to before 21.14.1021.14.10Patch availableCNA
—virtualenv (PyPI)21.14.8 to before 21.14.1021.14.10Patch availableGHSA-4f8h-vr72-p32c
  • virtualenv Vendorpypa Affected 21.14.8 to before 21.14.10 Fixed in 21.14.10 Patch available CNA
  • virtualenv (PyPI) Vendor— Affected 21.14.8 to before 21.14.10 Fixed in 21.14.10 Patch available GHSA-4f8h-vr72-p32c

Remediation

Upgrade the virtualenv PyPI package to version 21.14.10. Red Hat lists the following products as affected with no plan available: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces and Red Hat Satellite 6.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA virtualenv (pypa) Fixed in 21.14.10
  • Fix · GHSA-4f8h-vr72-p32c virtualenv (PyPI) Fixed in 21.14.10 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113713
  2. 2026-10-21 Affected versions changed · Red Hat
  3. 2026-10-21 CVSS score added · Red Hat
  4. 2026-10-23 Alias added: GHSA-4f8h-vr72-p32c
  5. 2026-10-23 Fix available: PyPI/[email protected] · GHSA-4f8h-vr72-p32c
  6. 2026-10-23 CVSS score added · GHSA-4f8h-vr72-p32c
  7. 2026-10-23 Weakness changed · GHSA-4f8h-vr72-p32c
  8. 2026-10-23 6 new references · GHSA-4f8h-vr72-p32c
  9. 2026-10-27 CISA SSVC decision points changed
  10. 2026-10-27 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 5

  • TI-2025-29803 setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write CVSS 4.0HIGH 7.7
  • TI-2024-05888 Remote Code Execution in pypa/setuptools CVSS 3.0HIGH 8.8
  • TI-2026-78525 Shell command injection in virtualenv generated POSIX launchers CVSS 3.1HIGH 7.8
  • TI-2026-78526 Command injection in virtualenv bash activation prompt CVSS 4.0HIGH 7.1
  • TI-2026-78521 Code injection in virtualenv Xonsh activation script CVSS 4.0HIGH 7.1
  • TI-2026-19377 wheel Allows Arbitrary File Permission Modification via Path Traversal CVSS 3.1HIGH 7.1
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences