CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

Summary

The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.

Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.

Affected area

Removal of a previously installed seed package.

Attacker-controlled input

An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.

Affected code

The relevant 21.14.8 source is in seed uninstall.

Mechanism

Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing seed-package metadata; --clear removes that tree first.

Reproduction and evidence

The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths. A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in place. The reproducer prints BUG only when the control files survive and both attack targets disappear.

The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.

Attack sequence

sequenceDiagram
    participant A as Prepared .venv metadata
    participant V as App-data seeder
    participant P as site-packages
    participant H as User home
    A->>P: top_level.txt names ../../../../../Documents
    A->>P: RECORD names ../../../../../notes.txt
    V->>P: read pip-1.0.dist-info before reinstall
    P->>H: join entries without containment check
    V->>H: remove Documents and notes.txt
    V-->>A: virtualenv exits successfully

Reproducer files

The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73 in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory update.

repro

#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path

work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")


def make_home(name):
    home = work / name
    (home / "Documents" / "thesis").mkdir(parents=True)
    (home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
    (home / "notes.txt").write_text("my notes\n")
    return home


def unpack_attacker_project(home, top_level_line,…

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.