CVE-2026-113719: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in pypa virtualenv

The vulnerability in virtualenv affects the PipInstall._uninstall_previous_version() function, which processes existing seed-package metadata during environment creation. Specifically, the _uninstall_dist() method joins entries from top_level.txt and RECORD files to site-packages without verifying that the paths are contained within the environment directory. This lack of containment checks allows relative path traversal, absolute paths, or linked parent directories to cause deletion of files outside the environment root. This deletion happens before the environment is fully created and only if the user has deletion rights on the targeted paths. Fresh environments without existing package metadata or those created with the --clear option do not trigger this issue. The vulnerability is addressed in virtualenv version 21.14.9.

An attacker with limited privileges who can influence the package metadata can cause deletion of arbitrary files outside the virtual environment directory during environment creation. This can lead to loss of data or disruption of other applications if critical files are deleted. The impact is limited by the requirement that the invoking user must have deletion permissions on the targeted files or directories. The CVSS score is 4.5 (medium severity), reflecting local attack vector, high attack complexity, low privileges required, and impacts on confidentiality, integrity, and availability.

Upgrade virtualenv to version 21.14.9 or later, where this path traversal and improper deletion issue is fixed. Avoid creating environments that reuse existing package metadata if upgrading is not immediately possible. Creating fresh environments without existing metadata or using the --clear option can also avoid triggering this vulnerability. No other specific mitigations are indicated.