Threats tagged 'bit-virtualenv-2026-113720'

virtualenv versions prior to 21.14.9 have a vulnerability where cached package files retain file permissions from an older cache due to the use of shutil.copy(). This can cause files to be writable by other local accounts if the cache was created under a permissive umask, potentially allowing modification and execution of package code by the environment owner. The issue is fixed in version 21.14.9.