CVE-2026-113719: Arbitrary File Deletion via Path Traversal in virtualenv Seed Package Metadata

Vulnerability ID: CVE-2026-113719
CVSS Score: 4.5
Published: 2026-10-23

A path traversal vulnerability in PyPA virtualenv prior to version 21.14.9 allows local attackers to cause arbitrary file and directory deletion when a virtual environment target directory containing untrusted distribution metadata is reused or reseeded.

TL;DR

virtualenv < 21.14.9 fails to validate path boundaries when parsing seed metadata during environment re-creation, allowing local malicious metadata to trigger arbitrary file deletion.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-113719
• CWE ID: CWE-22
• CVSS v3.1 Score: 4.5 (Medium)
• CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
• EPSS Score: 0.00117 (1.57th percentile)
• Impact: Arbitrary File Deletion
• Exploit Status: Proof of Concept / Local Pre-condition
• CISA KEV Status: Not Listed

Affected Systems

• virtualenv versions < 21.14.9 on Python environments (Linux, macOS, Windows)
• virtualenv: < 21.14.9 (Fixed in: 21.14.9)

Code Analysis

Commit: e3cea6f

Limit seed-package cleanup to entries inside the environment.

Limit seed-package cleanup to entries inside the environment. Ignore metadata entries that name the environment itself or resolve outside with a warning.

Exploit Details

• GitHub Security Advisory: Advisory details path traversal vulnerability during seed cleanup.

Mitigation Strategies

• Upgrade virtualenv package to version 21.14.9 or later.
• Enforce explicit --clear flag during automated virtual environment re-creation workflows.
• Restrict directory write permissions on target environments in shared system paths.

Remediation Steps:

1. Run 'pip install --upgrade virtualenv' to update to version >= 21.14.9.
2. Audit automated build scripts and CI/CD pipelines to ensure virtual environment reuse uses the --clear flag.
3. Verify system directory permissions on shared build locations to prevent local untrusted metadata injection.

References

• GitHub Security Advisory GHSA-hhxq-47xx-j5xx
• Fix Commit in pypa/virtualenv
• Pull Request #3428: Limit seed-package cleanup to entries inside the environment
• virtualenv Release Tag 21.14.9
• NVD CVE-2026-113719 Detail
• CVE.org Record for CVE-2026-113719

Read the full report for CVE-2026-113719 on our website for more details including interactive diagrams and full exploit analysis.