CVE-2026-113724: CWE-59: Improper Link Resolution Before File Access ('Link Following') in pypa virtualenv

The vulnerability arises because the safe_delete() function in virtualenv versions before 21.14.9 uses os.lstat and os.chmod in a way that follows symbolic links. When a deletion fails, safe_delete() reads the mode bits of the path and applies owner-write permissions. If an attacker plants a symlink inside a read-only directory pointing to a victim-owned target outside the directory, the target's permissions can be widened to be writable by the invoking user. This does not affect root and requires the user to own the target and have traversal access to its parent directories. The vulnerability is addressed by fixing this behavior in virtualenv version 21.14.9.

An attacker who can place a symlink inside a read-only directory can cause a victim-owned file outside the directory to become writable by the invoking user. This could lead to unauthorized modification of files by the user running virtualenv. The vulnerability requires the attacker to own the target file and have traversal access to its parent directories. Root is not affected by this issue. The CVSS score is 4.5 (medium severity), indicating limited impact with low attack vector and high attack complexity.

Upgrade virtualenv to version 21.14.9 or later, where this issue is fixed. No other mitigation is specified or required according to the available data.