Virtualenv Allows Symlink Attack on /tmp/

LOW 1.2CVE-2011-4617 · GHSA-3jhc-wjqf-5f2c · PYSEC-2011-23 · Published 31/12/2011 · updated 16/06/2026

In short

CVE-2011-4617 is a LOW (CVSS 1.2) vulnerability affecting virtualenv, virtualenv (python).
Chance of exploitation in the next 30 days (EPSS): 0.31%, higher than 23.9% of all vulnerabilities.
Fix: update to 1.5 or later.

Package	Affected versions	Patched versions
virtualenv PyPI	`< 1.5`	`1.5`
virtualenv python	`= 0.8= 0.8.1= 0.8.2= 0.8.3= 0.8.4= 0.9= 0.9.1= 0.9.2= 1.0= 1.1= 1.1.1= 1.2= 1.3= 1.3.1= 1.3.2= 1.3.3= 1.3.4= 1.4= 1.4.1= 1.4.2= 1.4.3= 1.4.4= 1.4.5= 1.4.6= 1.4.7= 1.4.8≤ 1.4.9`	No fix yet

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

NVD description

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.