Virtualenv versions prior to 1.2.2_1 and 2.5.1_1 have a vulnerability where files copied from a cached app-data directory retain file permissions from the cache rather than applying the current environment's umask. This can result in files with overly permissive access rights in new environments if the cache was created with a permissive umask, potentially allowing other local users to modify files such as pip scripts. The issue arises because shutil.copy preserves the source file mode, overriding the current umask. A fix is available in versions 1.2.2_1 and 2.5.1_1, which enforce stricter file permissions when copying from the cache.