CVE-2026-113721 is a vulnerability in virtualenv where generated activation files and pyvenv.cfg can follow existing symbolic links and write outside the intended environment. This occurs because the code checks for file existence without handling dangling symlinks properly, allowing writes to unintended targets if an attacker can prepare links in the destination. The vulnerability requires attacker-controlled links and write permissions on the linked targets. It was fixed in versions 1.6.2 and 1.18.1_2.