CVE-2026-113720

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/init.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/init.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.

Summary

The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments.

Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW in virtualenv-20261015-005, received on 15 October 2026.

Affected area

Permissions of files copied from app-data into a new environment.

Attacker-controlled input

The cache must contain files created with broader permissions than the current environment creator intends. Another account must also be able to traverse the new environment and reach those files. A private parent directory prevents that access. No control of a private live cache is assumed.

Affected code

The relevant 21.14.8 source is in copy helpers.

Mechanism

The default app-data seeder extracts a wheel into a reusable cache and copies its files into later environments with shutil.copy(). That function applies the cached source mode to each destination file after creating it, overriding the current run's umask. If the cache image was built under umask 000, a later environment created under umask 022 can receive mode-0666 pip files. The cache may be private while the new environment is reachable by other local accounts.

Reproduction and evidence

The scanner created two histories with separate private app-data caches. In the control, the owner's first run used umask 022; a later environment had no files writable by another account, and that account could not append to pip/__init__.py. In the attack history, the first run used umask 000 and the later run still used 022. The report counted 478 of 493 environment files writable by others. A second unprivileged uid appended a line to pip, and bin/pip --version ran it as the environment owner. The cache itself remained under a mode-0700 home in both histories.

An attacker cannot force the owner's earlier umask through this finding; the attack also needs a traversable destination. A mode-002 cache can expose group write access under suitable group permissions. The scanner dates app-data copy seeding to #1578, first released in 20.0.2. PR #3425 creates copied files under a fixed non-writable-by-others policy further restricted by the current umask.

Attack sequence

sequenceDiagram
    participant U as Environment owner
    participant C as Private app-data cache
    participant E as Later environment
    participant A as Other local account
    U->>C: first seed extraction under umask 000
    C-->>U: cached pip files have mode 0666
    U->>E: create environment under umask 022
    C->>E: shutil.copy reapplies mode 0666
    A->>E: append code to pip/__init__.py
    U->>E: run bin/pip --version
    E-->>U: appended code runs as owner

Reproducer files

The following files are from the scanner report for ANT-2026-487MH6OW. They were tested against commit a857a7823c73 in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory update.

repro

#!/usr/bin/env python3
import glob
import os
import shutil
import stat
import subprocess
import sys
from pathlib import Path

sys.stdout.reconfigure(line_buffering=True)  # keep these lines in order with those of the child processes
os.umask(0o022)  # for the directories made here as root
OWNER, OTHER_USER = 1000, 65534  # root is only needed to switch to these two unprivileged uids
VIRTUALENV = ["virtualenv", "--quiet", "--no-periodic-update"]  # default seeder; no network for the update check
# read…

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/init.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/init.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/init.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.