CVE-2026-113719 pypa CVE debrief

Who should care

Defenders responsible for managing virtual environments, especially those where users have deletion rights over package metadata paths, should assess exposure and prioritize patching.

Why it matters

Defenders should care about CVE-2026-113719 because it affects virtualenv, allowing potential unauthorized deletion of package metadata paths and possible elevation of privileges through malicious distribution metadata. Affected environments require verification and patching to version 21.14.9.

• Potential unauthorized deletion of package metadata paths
• Possible elevation of privileges through malicious distribution metadata
• Need for verification of affected versions and environments
• Priority for patching and updating virtualenv to version 21.14.9

Technical summary

The app-data seeder in virtualenv joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. This can lead to potential security issues if an environment being reused contains distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path. The relevant 21.14.8 source is in seed uninstall. Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info directory in the destination. _uninstall_dist() reads its `

Defensive priority

Defenders should prioritize verifying and applying the patch for virtualenv version 21.14.9, especially for environments where users have deletion rights over package metadata paths.

Recommended defensive actions

• Verify and apply the patch for virtualenv version 21.14.9
• Review and update environments where users have deletion rights over package metadata paths
• Monitor for and restrict potentially malicious distribution metadata
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in virtualenv, specifically in the app-data seeder, which joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.