CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder that improperly deletes files outside the intended environment during seed package removal. It occurs when the seeder processes distribution metadata containing paths that traverse outside the environment root, allowing deletion of arbitrary user files if the environment is reused and the user has deletion rights. This flaw was introduced in version 20.8.1 and fixed in virtualenvwrapper version 6.1.1_4.