virtualenv CVE-2026-113720

Requires all of: (1) a shared multi-user POSIX host; (2) virtualenv's app-data cache populated by an earlier run under a permissive umask (e.g. 0000 or 0002), so cached files carry group/world-write bits; (3) use of the app-data COPY seeder specifically (not the symlink seeder); (4) a destination/cache parent that is traversable rather than private - the description notes a private destination parent prevents access; and (5) the victim (environment owner) subsequently creating and executing from a later environment. Key limiting factors that reduce real-world risk: the attacker cannot force the earlier permissive umask (it must already have occurred), local access with a distinct account is required (PR:L), the attack has high complexity with a specific attack requirement (AC:H/AT:P), and victim interaction is needed to create and run the later environment (UI:P).

This is a genuinely low-priority, medium-severity issue despite affecting a very widely used tool. The CVSS 4.0 base score of 4.4 is driven down by a demanding precondition set: AV:L (local access only, not remote), AC:H (high attack complexity), AT:P (a specific attack requirement must be present), PR:L (attacker needs a local account), and UI:P (the victim must passively perform an action - creating a later environment). The only elevated metric is VI:H (integrity), reflecting that successful exploitation lets attacker-controlled code (e.g. pip/__init__.py) run as the environment owner; VC:L and VA:L are minor. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vulnerability class (CWE-732, incorrect permission assignment) combined with the description's own caveats - 'the attacker cannot force the earlier umask' and 'a private destination parent prevents access' - means exploitation depends on a pre-existing permissive-umask cache and a traversable, shared multi-user layout that the attacker cannot themselves create. Signals are internally consistent (local vector, config/timing-dependent, no exploitation intelligence), all pointing to a targeted local-multi-user edge case rather than a broadly exploitable flaw. Note the 'Information Disclosure' tag conflicts with the actual integrity/code-execution impact (VI:H, CWE-732) and appears mislabeled.

On a shared multi-user host where virtualenv's app-data cache was previously populated under a permissive umask, a local attacker with a separate account overwrites the resulting group/world-writable cached seed files (such as pip/__init__.py). When another user later creates a virtualenv using the app-data copy seeder and runs pip, the attacker's injected code executes under that victim's account. No public exploit was identified, and exploitation requires several non-default local conditions to already exist.