A vulnerability in virtualenv's app-data seeder allows deletion of files outside the intended environment during seed package reinstallation. This occurs because the uninstall process joins paths from distribution metadata without verifying containment within the environment, enabling deletion of arbitrary user files if malicious metadata is present. The issue requires an environment reused with attacker-controlled metadata and deletion rights by the invoking user. A fix is available in versions 1.2.2_1 and 2.5.1_1.