DEBIAN-CVE-2026-113713

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-113713
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113713.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-113713
Upstream
Published
2026-10-22T22:47:38Z
Modified
2026-10-22T23:00:08Z
Summary
[none]
Details

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.

References

Affected packages

Debian:12 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.17.1+ds-1
20.19.0+ds-1
20.21.0+ds-1
20.23.0+ds-1
20.23.0+ds-2
20.24.1+ds-1
20.24.6+ds-1
20.24.6+ds-2
20.25.0+ds-1
20.25.0+ds-2
20.25.1+ds-1
20.26.1+ds-1
20.26.2+ds-1
20.26.6+ds-1
20.27.0+ds-1
20.28.0+ds-1
20.29.1+ds-1
20.29.3+ds-1
20.30.0+ds-1
20.30.0+ds-2
20.30.0+ds-3
20.31.2+ds-1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113713.json"

Debian:13 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.31.2+ds-1
20.31.2+ds-1+deb13u1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113713.json"

Debian:14 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.31.2+ds-1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113713.json"