A vulnerability in virtualenv's app-data copy seeder causes files copied from a cache to retain permissions from an older cache population, potentially resulting in files with broader access rights than intended. This occurs because shutil.copy preserves the cached file modes, overriding the current umask. An attacker with access to the new environment and a cache populated under permissive permissions can exploit this to modify files such as pip scripts.