virtualenv EUVD-2026-105297

Exploitation requires a SECOND local account to have already created a directory symlink or Windows junction at one of the environment's executable, library, or package directory paths inside the requested destination, AND the invoking user must be able to access that pre-planted target. It only triggers during ordinary creation: the --clear option removes the planted tree before building and therefore prevents the issue, so vulnerable use is limited to default (non---clear) runs. Practical exploitation is further constrained by AC:H - the attacker must pre-position the link and satisfy access/timing conditions - and by PR:L, since a local account is needed; there is no remote or unauthenticated vector, and the write ceiling is bounded because arbitrary attacker-chosen content is not established.

This is a genuinely low-priority, locally-scoped issue rather than a high-impact remote flaw, and all available signals agree. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L = 4.5, MEDIUM) describes a local attack requiring an already-authenticated low-privilege account, high complexity (a second local account must pre-position a malicious symlink/junction and win access/timing conditions), and only low confidentiality, integrity, and availability impact. The description explicitly caps the integrity ceiling by noting 'arbitrary attacker-selected output bytes are not established,' so this is not a clean arbitrary-write-to-root primitive. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input; accordingly the exploitation status is: no public exploit identified at time of analysis. There are no conflicting signals - the CVSS local/high-complexity framing, the CWE-59 (link-following) classification, and the source diff (ensure_dir → ensure_within) are mutually consistent. The one caveat is scope of impact: while tagged 'Information Disclosure,' the mechanism is symlink-redirected writes through a linked parent, which is as much an integrity/path-traversal concern as a disclosure one, consistent with the balanced C:L/I:L/A:L scoring.

On a shared multi-user host, a low-privileged attacker pre-creates a directory symlink (or Windows junction) at a path the victim's virtualenv will use for its executable, library, or package directory. When the victim later runs an ordinary (non---clear) virtualenv creation, interpreter setup, seed installation, and activation generation write through the attacker's link to a location outside the intended destination, allowing the attacker to observe or corrupt the redirected files. No public exploit code was identified, and high attack complexity (pre-positioning plus access/timing) limits practical abuse.