virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data
    copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source
    modes to override the current run's umask. A cache populated under a permissive umask can therefore
    produce files writable by another local account in a later traversable environment, allowing package code
    such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force
    the earlier umask, and a private destination parent prevents access. This issue is fixed in version
    21.14.9. (CVE-2026-113720)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data     copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source     modes to override the current run's umask. A cache populated under a permissive umask can therefore     produce files writable by another local account in a later traversable environment, allowing package code     such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force     the earlier umask, and a private destination parent prevents access. This issue is fixed in version     21.14.9. (CVE-2026-113720)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477216	SCA: security update for virtualenv (GHSA-fc2g-4w5p-6whm)	Tenable Cloud Security	SCA Checks	Local	medium
477216	SCA: security update for virtualenv (GHSA-fc2g-4w5p-6whm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
370976	Linux Distros Unpatched Vulnerability : CVE-2026-113720	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-113720

medium

Tenable Plugins

medium

medium

medium