Threats tagged 'bit-virtualenv-2026-113716'

virtualenv versions prior to 21.14.9 contain a vulnerability where the builtin environment creator follows symlinked directories during creation. This behavior can cause interpreter creation, seed installation, and activation generation to write outside the intended virtual environment directory if another local user has prepared a linked directory accessible to the invoking user. The issue is fixed in version 21.14.9.