virtualenv EUVD-2026-105259

Requires symlink_app_data to be enabled via the environment variable (VIRTUALENV_SYMLINK_APP_DATA) or a configuration file (virtualenv.ini), combined with temporary/transient app-data (e.g. VIRTUALENV_OVERRIDE_APP_DATA pointing to an unusable cache). The command-line --symlink-app-data flag is already suppressed for transient app-data, so only the environment-variable and config-file forms reach the vulnerable state. Limiting factors that reduce real-world risk: local access only (AV:L), a local low-privileged account (PR:L), high attack complexity (AC:H) with a specific attack requirement (AT:P), passive user interaction (UI:P) in that the victim must create and then run the affected environment, and a non-default configuration (symlink seeding is not the default). Affected only in versions 21.14.8 through 21.14.9; fixed in 21.14.10.

This is a genuinely low-to-moderate priority issue, not a high-CVSS false alarm - the provided CVSS 4.0 base score is only 4.4 (Medium), and the vector reflects why: AV:L (local), AC:H (high complexity), AT:P (a specific attack requirement must be met), PR:L (attacker needs a local low-privileged account), and UI:P (passive user interaction). No EPSS score, KEV listing, or SSVC decision data was supplied; no public exploit identified at time of analysis. The combination of local-only reach, high complexity, required non-default configuration, and dependence on a victim actually running the affected environment all point to narrow, opportunistic rather than widespread exploitation. One signal to reconcile: the input Tag labels this 'Information Disclosure,' but the dominant impact in the CVSS 4.0 vector is VI:H (high integrity) with only VC:L confidentiality, and the root cause (CWE-377, insecure temporary file / environment bound to a cache path its owner no longer controls) is an integrity concern - defenders should treat this primarily as a code/file-substitution integrity risk, not primarily disclosure. EPSS/KEV absence is expected for a freshly disclosed dev-tool bug and should not be read as low risk by itself.

On a shared multi-user host, a victim creates a virtualenv with symlink seeding enabled through an environment variable or config file while app-data is temporary; after creation the temporary cache is deleted, leaving the environment linked to a cache pathname the victim no longer controls. A local attacker who can create files at that now-unowned path plants malicious package content, and when the victim runs Python from the seeded environment, the attacker-influenced files are loaded. No public exploit is identified at time of analysis, and the high complexity plus required configuration make this an opportunistic, targeted scenario.