CVE-2026-113713

Public on 2026-10-20
Modified on 2026-10-22
Description
virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.7
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core python-virtualenv Not Affected
Amazon Linux 2023 python-virtualenv Pending Fix
Amazon Linux 2027 Preview python-virtualenv Pending Fix
Amazon Linux 2023 python3.13-virtualenv Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H