CVE-2026-113719

Received Received - Intake

Path Traversal in virtualenv Prior to 21.14.9

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113719

EUVD

EUVD-2026-105300

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-113719 is a path traversal vulnerability in virtualenv versions up to 21.14.8. It occurs during environment creation when the cleanup process deletes files outside the intended virtual environment due to improper validation of metadata deletion paths. Attackers can exploit malicious distribution metadata to trigger unintended deletions if the user has deletion rights over the affected paths.

Detection Guidance

Check virtualenv version with pip show virtualenv. If version is <=21.14.8, the system is vulnerable. Inspect environment creation logs for unexpected file deletions or path traversal attempts in metadata files like top_level.txt or RECORD.

Impact Analysis

This vulnerability can lead to data loss or system compromise if an attacker manipulates metadata to delete critical files outside the virtual environment. It requires local access and some user privileges but could allow deletion of sensitive files, including those outside the environment root. Fresh environments or those created with --clear are not affected.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later using pip install --upgrade virtualenv. Avoid reusing existing virtual environments with untrusted metadata. Use --clear flag during creation to prevent metadata reuse.

Hi! I’m here to help you understand CVE-2026-113719. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70