A vulnerability in virtualenv's app-data copy seeder causes files copied from a cached wheel to retain file permissions from the cache, which may be more permissive than intended. This occurs because shutil.copy preserves the cached file modes regardless of the current umask. If the cache was created under a permissive umask (e.g., 000), files in later environments can be writable by other local accounts, potentially allowing unauthorized code modification and execution. The issue affects virtualenv versions from 2018.11.26_4 up to but not including 2026.10.1. A fix is available in version 2026.10.1 that enforces stricter file permissions when copying from the cache.