CVE-2026-113716: virtualenv < 21.14.9

CVE-2026-113716. CVSS 3.1 base score 4.5 (MEDIUM, Vendor/CNA).

Affected technology

virtualenv · < 21.14.9
pypa

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

The source says interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination when another local account prepared the tree and the invoking user can access the target. Vendor/CNA’s CVSS 3.1 assessment (base score 4.5/10) rates confidentiality, integrity and availability impact as low.

Published 20-Oct-2026 21:23 UTC

CWE: CWE-59
CCR priority: 18.0 /100 (P5)
CVSS 3.1: 4.5 /10 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L · Vendor/CNA
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-20 21:22:07.084487+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-113716.html