CVE-2026-113724: 
Python vulnerability analysis and mitigation

CVE-2026-113724 is a symlink-following vulnerability in the safe_delete() function of virtualenv, a tool for creating isolated Python environments. Prior to version 21.14.9, the deletion error handler reads mode bits using os.lstat(path) but applies permissions via os.chmod(path, ...), which follows symbolic links — allowing a planted symlink inside a read-only directory to cause a victim-owned file outside the destination to become world-writable (mode 0777). All versions of virtualenv before 21.14.9 (confirmed on 21.14.8) are affected; the fix was released in version 21.14.9. It carries a CVSS v3.1 base score of 4.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is CWE-59 (Improper Link Resolution Before File Access — 'Link Following'). The vulnerable code path is in safe_delete(), which uses shutil.rmtree() with an error handler that calls os.lstat(path) to read mode bits (which reads the symlink's own mode, fixed at 0777 on Linux) and then os.chmod(path, ...) to apply them — but os.chmod follows symlinks by default, and os.chmod is not listed in os.supports_follow_symlinks on Linux, so there is no portable way to change the link itself. An attacker plants a symlink inside a read-only directory (e.g., venv/bin/python/) pointing to a victim-owned file (e.g., keys/deploy.pem at mode 0400); when virtualenv attempts to delete the directory and fails due to missing write permission, the error handler inadvertently sets the symlink target's mode to 0777. The attack requires the invoking user to own the target file and have permission to change its mode; root does not reach this failure path (GitHub Advisory, Fix PR).

Successful exploitation causes a victim-owned file (e.g., a private key or configuration file) outside the virtualenv destination directory to have its permissions widened to 0777 (world-readable, world-writable, world-executable), even though virtualenv does not itself read the target. Any other local account that can traverse the target file's parent directories can then read or modify the file, potentially exposing sensitive credentials or enabling unauthorized data tampering. The vulnerability does not directly grant code execution or root access, but the integrity and confidentiality of sensitive files owned by the invoking user are at risk (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and reported by Anthropic's OSS Scanner (internal identifier ANT-2026-UK90QC27) on October 15, 2026, and disclosed publicly on October 17–20, 2026 (GitHub Advisory, Feedly).

1. Prepare a malicious archive: Craft a tar archive containing a read-only directory (e.g., proj/venv/bin/python/ with mode 0555) and a symlink inside it (e.g., proj/venv/bin/python/entry) pointing to a victim-owned sensitive file outside the project directory (e.g., ../../../../keys/deploy.pem).
2. Deliver the archive: Distribute the archive to a target user (e.g., as a project template or shared environment), relying on tar or cp -a to preserve the read-only directory mode and symlink.
3. Trigger virtualenv: Cause the victim to run virtualenv venv or virtualenv --clear venv inside the unpacked project directory. The victim must own the target file (e.g., keys/deploy.pem) and have permission to change its mode.
4. Exploit the error handler: When shutil.rmtree() attempts to delete the read-only directory and fails (EACCES), safe_delete()'s error handler calls os.lstat(path) on the symlink (returning mode 0777, the symlink's own mode on Linux) and then os.chmod(path, 0777), which follows the symlink and sets the target file's mode to 0777.
5. Access the widened file: Any local account that can traverse the parent directories of the target file can now read or modify it (e.g., read keys/deploy.pem to extract a private key). The virtualenv operation itself exits with a PermissionError, but the damage to the target file's permissions persists (GitHub Advisory, Fix PR).

• File System: Sensitive files (e.g., private keys, configuration files) owned by a user with unexpectedly changed permissions (e.g., mode changed from 0400 to 0777); presence of a symlink inside a read-only directory within a virtualenv tree pointing to a file outside the destination directory.
• Logs: PermissionError messages in virtualenv output referencing a read-only directory inside a venv/bin/ path (e.g., PermissionError: [Errno 13] Permission denied: '.../venv/bin/python/entry').
• Process: Invocation of virtualenv venv or virtualenv --clear venv in a directory containing a pre-existing venv/ tree with unusual read-only subdirectories or symlinks pointing outside the project root.
• File System: Unexpected symlinks inside venv/bin/ or similar virtualenv subdirectories that resolve to paths outside the virtualenv destination directory (GitHub Advisory).

Upgrade virtualenv to version 21.14.9 or later, which fixes the issue by no longer performing POSIX mode changes on deletion failure (the error is re-raised immediately on POSIX), and on Windows uses a native handle that opens the entry itself without following reparse points (GitHub Release, Fix PR). As a workaround, avoid recursively clearing virtualenv destinations that were populated by another account, and inspect any failing entry before retrying cleanup with broader privileges. Additionally, restrict directory permissions to prevent unprivileged users from planting symlinks in sensitive directories (GitHub Advisory).

The vulnerability was reported by Anthropic's OSS Scanner (ANT-2026-UK90QC27) and disclosed responsibly to the virtualenv maintainer (gaborbernat), who published the security advisory and fix on October 17, 2026. Red Hat tracked the issue via Bugzilla (Bug 2556419) with a medium severity rating and a CC list of 65 users, indicating broad internal awareness across Red Hat product teams (Red Hat Bugzilla, GitHub Advisory). No significant public social media discussion or independent researcher commentary has been identified beyond the official advisory and patch.