CVE-2026-113719
published 2026-10-20CVE-2026-113719: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing…
PriorityP423medium4.5CVSS 3.1
AVLACHPRLUINSUCLILAL
EPSS
0.14%
3.6th percentile
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| debian | python-virtualenv | — | — |
| devspaces | udi-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| pypa | virtualenv | < 21.14.9 | 21.14.9 |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-kserve-agent-rhel9 | — | — |
| rhoai | odh-kserve-controller-rhel9 | — | — |
| rhoai | odh-kserve-router-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
| rhoai | odh-ta-lmes-job-rhel9 | — | — |
| rhoai | odh-training-rocm64-torch28-py312-rhel9 | — | — |
| rhoai | odh-trustyai-nemo-guardrails-server-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| satellite | iop-advisor-backend-rhel9 | — | — |
| satellite | iop-host-inventory-rhel9 | — | — |
| satellite | iop-yuptoo-rhel9 | — | — |
| virtualenv | virtualenv | >= 0 < 21.14.9 | 21.14.9 |
CVSS provenance
nvdv3.14.5MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
vendor_redhat4.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
virtualenv: virtualenv: Arbitrary file deletion via path traversal in package metadata
vendor_redhat·2026-10-20·CVSS 4.5
CVE-2026-113719 [MEDIUM] CWE-22 virtualenv: virtualenv: Arbitrary file deletion via path traversal in package metadata
virtualenv: virtualenv: Arbitrary file deletion via path traversal in package metadata
A flaw was found in virtualenv. This vulnerability allows a local attacker to cause arbitrary file deletion outside the target environment directory. When creating an isolated environment in a reused directory, virtualenv processes existing package metadata during cleanup without verifying that file paths stay within the environment boundary. If an attacker influences distribution metadata in that location, directory traversal entries or absolute paths can cause virtualenv to delete unintended files with the permissions of the user running the command.
Package: openshift-lightspeed/lightspeed-service-api-rhel9 (OpenShift Lightspeed) - Fix deferred
Package: ansible-automation-platform-26/controller-rhe
GHSA
virtualenv: Seed replacement does not contain metadata deletion paths
ghsa·2026-10-23
CVE-2026-113719 [MEDIUM] CWE-22 virtualenv: Seed replacement does not contain metadata deletion paths
virtualenv: Seed replacement does not contain metadata deletion paths
## Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths
without checking containment within the environment.
Anthropic's OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.
## Affected area
Removal of a previously installed seed package.
## Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must
have deletion rights over the paths named by that metadata. Installing a new environment without existing package
metadata does not enter this cleanup path.
## Affected code
The relevant 21.14.8 source is in
[
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-20
Published