CVE-2026-113713: medium-severity vulnerability in pypa virtualenv
virtualenv: Temporary app-data can leave dangling seed package links
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.4epss 0.2%
virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
pypa · virtualenvRelated CVEs — pypa virtualenv
In the same product, most dangerous first.
CVE-2026-113726HIGHvirtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTEPSS 0.3%CVE-2026-113717LOWvirtualenv: Pip seeding with download omits wheel digest verificationEPSS 0.3%CVE-2026-113722HIGHvirtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxEPSS 0.3%CVE-2026-115586HIGHvirtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)EPSS 0.3%CVE-2026-113776HIGHvirtualenv activation scripts run code from a path that contains a placeholder nameEPSS 0.3%CVE-2026-113725HIGHvirtualenv bash activate runs commands from an environment name with a backslash before $EPSS 0.3%