CVE-2026-113716 in virtualenv
Summary
by MITRE • 10/20/2026
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination when another local account prepared the tree and the invoking user can access the target. The --clear option removes the planted tree first, while ordinary creation reaches it; arbitrary attacker-selected output bytes are not established. This issue is fixed in version 21.14.9.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in virtualenv versions prior to 21.14.9 represents a significant directory traversal and symlink following flaw that compromises the isolation guarantees central to Python's virtual environment tooling. Virtual environments are designed to provide isolated execution contexts, preventing interference between different project dependencies and system-wide packages. This security model relies heavily on the assumption that files written by the creator remain strictly within the designated target directory structure. However, a logic error in the ensure_dir function allowed an attacker who had prior access to create symlinks pointing outside the intended virtual environment root to redirect file writes into arbitrary locations accessible to the invoking user.
The technical core of this flaw lies in how Python's os.path.exists and subsequent directory creation routines handle symbolic links. When virtualenv attempts to initialize directories for executables, libraries, or packages, it calls ensure_dir to verify existence before proceeding with write operations. The implementation incorrectly treated an existing symlink pointing to a valid directory as safe, following the link rather than validating that the final destination resides within the sandboxed environment. Consequently, if a malicious actor previously created a symbolic link at a path where virtualenv expected a new directory, subsequent creation of interpreter files or seed installations would write data through that symlink. This effectively bypasses the containment boundary, allowing writes to any location on the filesystem for which the invoking user has permission.
The operational impact of this vulnerability is primarily focused on local privilege escalation and file system manipulation rather than remote code execution or arbitrary byte injection. Because virtualenv does not establish arbitrary attacker-selected output bytes directly but instead utilizes standard installation routines, an attacker cannot inject malicious payloads into critical system binaries through this specific vector alone. However, the ability to write files outside the sandbox allows for significant disruption of other projects running on the same account. An adversary could overwrite configuration files, corrupt dependency caches, or plant scripts in locations that are subsequently executed by automated processes or other users sharing the environment. This undermines the integrity and confidentiality assurances provided by virtual environments, particularly in shared development servers or continuous integration pipelines where multiple accounts may interact with similar directory structures.
This vulnerability aligns with CWE-59 Improper Link Resolution Before File Access, commonly known as a Time-of-check to Time-of-use (TOCTOU) race condition variant involving symbolic links. The failure to validate the canonical path of existing directories before writing constitutes a classic link following error. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates lateral movement and persistence techniques by allowing an attacker to manipulate files in unintended locations within a compromised user account. It also relates to CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as the tool fails to restrict file system writes strictly to the intended sandboxed root directory due to inadequate path normalization checks during initialization.
Mitigation for this issue requires an immediate upgrade to virtualenv version 21.14.9 or later, where the ensure_dir function has been patched to resolve symlinks and verify that the final resolved path remains within the expected target directory before proceeding with any write operations. Organizations relying on automated build systems should also audit their CI/CD pipelines for potential symlink injection points in shared workspace directories. Additionally, developers should avoid running virtualenv creation commands as privileged users or in environments where untrusted actors have write access to parent directories of intended virtual environment roots. Implementing strict file system permissions and using immutable attributes on critical project directories can further reduce the risk of such link-based bypasses until all instances are updated.