Directory Traversal Vulnerability in Virtualenv Tool by PyPA

CVE-2026-113719

What is CVE-2026-113719?

Virtualenv, a tool for creating isolated Python environments, has a directory traversal vulnerability that allows potential deletion of files outside a specified environment. Prior to version 21.14.9, the function PipInstall._uninstall_previous_version() improperly handled seed-package metadata. This could lead to situations where deletion occurs on paths beyond the intended environment, especially if those paths contained metadata influenced by other accounts. Such actions can happen during the environment creation phase and can have severe implications if the user holds deletion rights over these paths. To mitigate these risks, users are strongly advised to upgrade to version 21.14.9 or later.

References