Threats affecting pkg:brew/charm-tools

A vulnerability in virtualenv's app-data copy seeder causes files copied from a cache to retain permissions from an older cache population, potentially resulting in files with broader access rights than intended. This occurs because shutil.copy preserves the cached file modes, overriding the current umask. An attacker with access to the new environment and a cache populated under permissive permissions can exploit this to modify files such as pip scripts.

A vulnerability in virtualenv's app-data seeder allows deletion of arbitrary files outside the intended environment during seed package removal. This occurs because the uninstallation code does not verify that paths derived from distribution metadata remain within the environment, enabling path traversal attacks. The issue requires an existing environment with malicious metadata and user deletion permissions on targeted paths. It was reported by Anthropic's OSS Scanner and affects versions starting from 20.8.1 where the cleanup code was introduced. A fix was implemented in PR #3428 to prevent deletion outside the environment root.

CVE-2026-113715 is a low-severity vulnerability in virtualenv's venv creator configuration readback. The issue arises because virtualenv reads the standard library's pyvenv.cfg file using splitlines(), which treats certain Unicode line-boundary characters (e.g., U+2028) as line breaks. An attacker-controlled destination path containing such characters can inject additional configuration keys, altering environment settings like 'home' and 'include-system-site-packages'. This can change which standard-library files the interpreter loads and weaken environment isolation. The vulnerability requires using the venv creator in virtualenv and an attacker-controlled destination path with line-boundary characters. A fix was introduced in pull request #3426, which rejects line-boundary characters before creation and rebuilds the configuration from selected settings.