CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder that improperly deletes files outside the intended environment during seed package reinstallation. It occurs when the seeder processes existing distribution metadata containing path entries that traverse outside the environment root, leading to unintended deletion of user files. This requires an environment reused with metadata influenced by another account and deletion rights by the invoking user. The issue was introduced in version 20.8.1 and fixed in versions 2022.8.7_1 and 2026.10.20.