Prior to version 21.14.9, virtualenv’s seeder copied cached package files using shutil.copy(), preserving the files’ original permission bits and ignoring the current run’s umask. If the cache had been created under a permissive umask, the resulting virtual environment could contain files writable by any local user. An attacker who can create or modify a virtual environment could therefore overwrite critical package modules such as pip/__init__.py, enabling execution of arbitrary code within that environment. This flaw is a local privilege escalation that allows modification of package contents.

All installations of the Python Packaging Authority’s virtualenv older than version 21.14.9 are vulnerable. The security team released version 21.14.9 with a patch that replaces the copy-based seeder with logic that respects the current run’s umask, thereby preventing permission leakage.

The CVSS score of 4.4 indicates low to moderate severity. The EPSS score is < 1 %, showing a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting there are few known exploits. Based on the description, the attack vector is local; an attacker must have the ability to run or modify a virtual environment on the same machine, and cannot force a permissive umask or bypass a private destination parent. Consequently, the risk is restricted to environments with insufficient local isolation.