{"id":"CVE-2026-113713","aliases":[],"title":"virtualenv: Temporary app-data can leave dangling seed package links","description":"virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.","severity":"medium","score":4.4,"published":"2026-10-20T19:06:25.880Z","modified":"2026-10-27T13:37:48.952Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c","https://github.com/pypa/virtualenv/pull/3437","https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e","https://github.com/pypa/virtualenv/releases/tag/21.14.10"],"sources":[{"name":"CVE","id":"CVE-2026-113713","modified":"2026-10-27T13:37:48.952Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-113713"}],"assessments":[{"source":"CNA","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","score":4.4}]}