Threats tagged 'bit-virtualenv-2026-113724'

A vulnerability in virtualenv prior to version 21.14.9 allows a symlink target's mode to be changed during deletion recovery. The safe_delete() function's error handler follows symlinks and applies owner-write permissions, which can unintentionally widen write access to a target file owned by the user. This occurs if a symlink is planted inside a read-only directory, potentially making the target broadly writable before the deletion retry fails. The issue is fixed in version 21.14.9.