virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can therefore cause a victim-owned target outside the destination that is initially not writable by the invoking user to become broadly writable before the retry fails, provided that user owns the target and can change its mode. Another account can use the widened mode only if it can traverse the target's parent directories; root does not reach the demonstrated failure path, and the operation does not itself read the target. This issue is fixed in version 21.14.9.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the     safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path)     and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link     inside a read-only directory can therefore cause a victim-owned target outside the destination that is     initially not writable by the invoking user to become broadly writable before the retry fails, provided     that user owns the target and can change its mode. Another account can use the widened mode only if it can     traverse the target's parent directories; root does not reach the demonstrated failure path, and the     operation does not itself read the target. This issue is fixed in version 21.14.9. (CVE-2026-113724)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the
    safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path)
    and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link
    inside a read-only directory can therefore cause a victim-owned target outside the destination that is
    initially not writable by the invoking user to become broadly writable before the retry fails, provided
    that user owns the target and can change its mode. Another account can use the widened mode only if it can
    traverse the target's parent directories; root does not reach the demonstrated failure path, and the
    operation does not itself read the target. This issue is fixed in version 21.14.9. (CVE-2026-113724)

ID	Name	Product	Family	Type	Severity
370971	Linux Distros Unpatched Vulnerability : CVE-2026-113724	Nessus	Misc.	Local	medium
476661	Chainguard: openstack-rally-2026.1: security update to 4.1.0-r5	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476661	Chainguard: openstack-rally-2026.1: security update to 4.1.0-r5	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
476593	SCA: security update for virtualenv (GHSA-43mp-35q3-x3fq)	Tenable Cloud Security	SCA Checks	Local	medium
476593	SCA: security update for virtualenv (GHSA-43mp-35q3-x3fq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-113724

medium

Tenable Plugins

medium

medium

medium

medium

medium