Medium severity · published Oct 20, 2026
CVE-2026-113713
virtualenv: Temporary app-data can leave dangling seed package links
4.4
CVSS
0.1%
EPSS
No
On KEV
Description
virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
virtualenv · pypa
>= 21.14.8, < 21.14.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113713
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113713
github.com
https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e
github.com
https://github.com/pypa/virtualenv/pull/3437
github.com
https://github.com/pypa/virtualenv/releases/tag/21.14.10
github.com
https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c
More from virtualenv
7.8
CVE-2026-113726
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
7.8
CVE-2026-113776
virtualenv activation scripts run code from a path that contains a placeholder name
7.8
CVE-2026-113732
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
7.8
CVE-2026-113725
virtualenv bash activate runs commands from an environment name with a backslash before $
7.8
CVE-2026-113722
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax