A vulnerability in virtualenv's app-data copy seeder causes files copied from a cache to retain their original permissions, potentially wider than intended. This occurs because shutil.copy preserves cached file modes regardless of the current umask, allowing files created under permissive umask 000 to be copied with mode 0666 in later environments. An attacker with local access and the ability to traverse the environment can exploit this to modify files such as pip/__init__.py, leading to code execution as the environment owner. The issue affects virtualenv versions prior to 2.20.0_1 and 4.7.0_1. A fix is available that enforces stricter file permissions on copied files.