virtualenv: Temporary app-data can leave dangling seed package links

Summary The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappdata can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. Anthropic's OSS Scanner reported this as ANT-2026-ZOE2GEPC in virtualenv-20261015-005, received on 15 October 2026. This draft records source review and functional remediation checks. The reporter's cross-account code-execution claim has not been independently reproduced. Affected area Integrity of app-data references after temporary cache cleanup. Attacker-controlled input Symlink seeding must be enabled through VIRTUALENVSYMLINKAPPDATA or symlinkappdata in the configuration file, and app-data setup must fall back to a temporary directory. A missing or unwritable configured cache can cause that fallback. Ordinary copy seeding does not leave these references. The security concern requires a shared temporary-directory parent where another account can acquire the deleted cache pathname, followed by use…

curl https://cve.zerocrew.in/api/cve/CVE-2026-113713