CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder that improperly deletes files outside the intended environment during seed package removal. It occurs when distribution metadata contains paths that traverse outside the environment, allowing deletion of arbitrary files if the invoking user has permissions. This affects reuse of environments containing metadata influenced by another account. The issue was introduced in version 20.8.1 and fixed in versions 2.20.0_1 and 4.7.0_1.