CVE-2026-113720: CWE-732: Incorrect Permission Assignment for Critical Resource in pypa virtualenv

The vulnerability in pypa virtualenv versions before 21.14.9 involves the app-data copy seeder using shutil.copy() to copy cached package files, which causes the copied files to inherit the source file's permissions rather than applying the current environment's umask. If the cache was created under a permissive umask, files can become writable by other local accounts in subsequent environments. This allows modification of package code like pip/__init__.py, which can then be executed by the environment owner. The attacker cannot influence the original umask, and private destination parent directories prevent unauthorized access. The issue is resolved in version 21.14.9.

Local users with access to the cached package files can exploit this vulnerability to modify package code in virtual environments created later, potentially leading to execution of malicious code by the environment owner. However, the attacker cannot force the original umask, and access is limited by private destination directories. The CVSS 4.4 score reflects a medium impact with local attack vector, high attack complexity, and partial privileges required.

Upgrade virtualenv to version 21.14.9 or later, where this issue is fixed. No additional mitigation is required as the fix addresses the permission assignment problem directly.