CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder that improperly deletes files outside the intended environment during seed package removal. It occurs when reusing an environment containing manipulated distribution metadata with paths that escape the environment root, leading to deletion of arbitrary user files. The issue requires the invoking user to have deletion rights on those paths and an environment reused from another account's metadata. This flaw was introduced in version 20.8.1 and fixed in version 4.67.0.