CVE-2026-113713: Insecure Temporary File Symlink Handling in PyPA virtualenv

The Python package virtualenv is a foundational component of the Python software ecosystem used to create isolated execution environments. To populate new environments with core utility packages—including pip, setuptools, and wheel—virtualenv utilizes seeder mechanisms, primarily the app-data seeder (FromAppData).

When the default application data directory is unwritable or restricted by system permissions, virtualenv falls back to creating a transient storage directory within system temporary storage (such as /tmp). When configured to seed packages via symbolic links, virtualenv creates symlinks in the new environment's site-packages directory that point directly into this transient application data cache.

Upon completion of the virtual environment creation process, virtualenv performs cleanup operations and deletes the transient application data folder. This leaves dangling symbolic links inside the target environment's site-packages directory pointing to file paths that no longer exist.

The root cause of CVE-2026-113713 lies in incomplete validation of the application data directory's transient state during option evaluation within the FromAppData seeder class, categorized under CWE-377 (Insecure Temporary File).

While command-line option parsing included logic to explicitly disable --symlink-app-data whenever temporary application data was active, this protection was bypassed when symlink seeding was requested through environment variables (such as VIRTUALENV_SYMLINK_APP_DATA=true) or configuration file settings in virtualenv.ini.

The constructor for FromAppData assigned self.symlinks = options.symlink_app_data without verifying whether self.app_data.transient evaluated to True. Consequently, symlinks were generated pointing into transient directory structures, which were subsequently deleted from the host filesystem upon completion of environment creation.

Analyzing the implementation within src/virtualenv/seed/embed/via_app_data/via_app_data.py highlights how configuration option processing was updated in commit b81995c3feab9e1edb453c75ffc6616e1a77335e.

In vulnerable versions 21.14.8 and 21.14.9, the initialization method directly trusted options.symlink_app_data without evaluating self.app_data.transient. The patch updates the assignment to enforce an explicit conditional check that suppresses symlink creation if the application data location is transient.

class FromAppData(BaseEmbed):
    def __init__(self, options: VirtualEnvOptions) -> None:
        super().__init__(options)
        # Vulnerable:
        # self.symlinks = options.symlink_app_data
        # Patched:
        self.symlinks = options.symlink_app_data and not self.app_data.transient
        if options.symlink_app_data and self.app_data.transient:
            LOGGER.debug("copy seed packages because temporary app-data is removed after creation")

By ensuring that self.symlinks resolves to False whenever self.app_data.transient is True, virtualenv safely falls back to copying seed package files instead of creating links to transient paths.

Exploitation occurs in shared multi-user operating system environments where unprivileged users share access to common temporary directories such as /tmp.

An attacker monitors system temporary directories or predicts the temporary directory path pattern created during virtualenv execution. When a victim user creates a virtual environment using transient application data while symlinking is configured via environment variables, virtualenv creates dangling links and deletes the temporary directory.

The attacker subsequently creates the expected directory structure in the shared temporary directory and inserts a malicious Python module (e.g., pip/__init__.py). When the victim invokes Python binaries or imports modules from within the affected virtual environment, the Python interpreter resolves the dangling symlink to the attacker-controlled path, executing the malicious code under the victim user context.

Successful exploitation allows an unprivileged local attacker to execute arbitrary code with the full privileges of the victim user. In shared workstation or multi-tenant CI/CD build environments, this enables local privilege escalation to match the targeted user account.

The vulnerability is assessed with a CVSS v4.0 Base Score of 4.4 (CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N). The High Integrity rating reflects the complete loss of control over code executed within the victim's Python virtual environment.

The EPSS score is 0.00107, placing it in the 1.10th percentile for predicted exploitation probability. The flaw is not listed in the CISA KEV catalog, and no public weaponized exploit code has been identified.

To remediate CVE-2026-113713, upgrade virtualenv to version 21.14.10 or later using standard Python package management tools:

pip install --upgrade virtualenv>=21.14.10

If immediate upgrading is not feasible, administrators should audit multi-user build environments to ensure VIRTUALENV_SYMLINK_APP_DATA is not enabled in environment variables or system-wide virtualenv.ini configuration files.

System administrators should also enforce directory access controls on shared temporary storage, ensuring the sticky bit (chmod +t /tmp) is enabled and utilizing isolated temporary directory namespaces (PrivateTmp=true in systemd services) for automated build workflows.