CVE-2026-113716: CWE-59: Improper Link Resolution Before File Access ('Link Following') in pypa virtualenv

The vulnerability arises because virtualenv's builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts existing symlinks since exists() follows them. As a result, interpreter creation, seed installation, and activation generation may write through the linked parent directory outside the requested destination if another local account has prepared the directory tree with symlinks accessible to the invoking user. The --clear option mitigates this by removing the planted tree first. This improper link resolution before file access (CWE-59) can lead to unintended writes outside the target directory. The issue is resolved in virtualenv version 21.14.9.

An attacker with local access who can prepare a directory tree with symlinks accessible to the invoking user may cause virtualenv to write files outside the intended isolated environment. This could lead to limited confidentiality, integrity, and availability impacts on the local system. The CVSS score of 4.5 reflects a medium severity with local attack vector, high attack complexity, low privileges required, and no user interaction needed.

Upgrade virtualenv to version 21.14.9 or later where this issue is fixed. The --clear option can mitigate the issue by removing the planted directory tree before creation, but the recommended action is to apply the official fix by upgrading.