CVE-2026-113713: CWE-377: Insecure Temporary File in pypa virtualenv

The virtualenv tool for creating isolated Python environments had a security issue in versions 21.14.8 and 21.14.9 where the app-data seeder could leave an environment linked to temporary package files that virtualenv deletes after creation. The vulnerability arises because the environment-variable and configuration-file forms of the symlink_app_data option can enable this insecure state even if the command-line flag for temporary app-data is disabled. This results in the environment relying on a cache pathname that the environment owner no longer controls, constituting an insecure temporary file condition (CWE-377). The vulnerability was addressed and fixed in version 21.14.10.

An attacker with limited privileges could exploit this vulnerability to influence or interfere with the temporary package files used during virtual environment creation, potentially leading to unauthorized access or modification of environment contents. The CVSS 4.4 score reflects a medium severity with local attack vector, high attack complexity, and partial user interaction required. The impact includes loss of integrity and availability of the virtual environment data.

Upgrade virtualenv to version 21.14.10 or later where this vulnerability is fixed. No other mitigations are indicated or necessary as the fix addresses the insecure temporary file handling.