The safe_delete handler attempts to recover from a deletion error by inspecting and restoring permission bits on the file it failed to remove. Because it follows symlinks when fetching the mode, a symlink pointing to a target outside the intended directory can be used to set that target’s permissions, turning an otherwise non‑writable file into a writable one. This permission escalation can allow a local user to overwrite or tamper with artifacts that should be protected, potentially compromising the isolation of the virtual environment.

Vulnerable versions of the PyPA virtualenv tool up to and including 21.14.8, and any earlier releases, are affected. The issue does not apply to version 21.14.9 and newer, which contain a fix that prevents the symlink resolution during mode restoration.

The CVSS score of 4.5 classifies this as a moderate risk. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. The bug is exploitable in a local context, requiring that the attacker create a symlink inside a directory that virtualenv will delete. The attacker must own the target file to be able to change its mode; traversal of the target’s parent directories is necessary for another account to benefit from the widened permissions. Root cannot reach the failure path, reducing the danger of a system-wide compromise. Nonetheless, an unprivileged user could subvert the isolation guarantees of virtualenv.