CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder that improperly deletes files outside the intended environment during seed package removal. It occurs when existing distribution metadata contains paths that traverse outside the environment, allowing deletion of arbitrary files accessible by the invoking user. This affects virtualenv versions from 2021.11.9 up to but not including 2026.10.1. The issue was fixed in version 2026.10.1.