Cloudanix VulnDB

CVE-2026-113719

Medium · 4.5

CVSS

4.5

EPSS

0.2%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the virtualenv tool could let someone trick it into deleting important files on your computer when you create a new Python environment in a shared folder.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Data Tampering
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Path traversal in virtualenv allows _uninstall_dist to join untrusted top_level.txt/RECORD entries from reused seed-package metadata directly into site-packages paths, enabling deletion of arbitrary files outside the target environment during creation when the invoking user has write access to those paths.

Why it matters to the business

Attackers can cause unintended deletion of files on shared systems during routine Python environment setup, leading to data loss, broken applications, or operational disruption before any environment is even used.

How an attack unfolds

An attacker places a malicious distribution with crafted RECORD or top_level.txt containing relative or absolute paths in a location that will be reused as a virtualenv destination; when a victim later runs virtualenv on that path the cleanup routine follows the malicious entries and deletes files outside the environment using the victim's permissions.

How to fix it

Upgrade virtualenv to version 21.14.9 or later; prefer fresh environment creation with the --clear flag; avoid reusing directories that may contain untrusted package metadata.

How to confirm the fix worked

Confirm the installed virtualenv version is at least 21.14.9; test environment creation in a directory containing known malicious metadata and verify no files outside the environment root are removed.

Typical attack path

  1. Plant malicious seed-package metadata containing traversal or absolute paths in a shared or reused directory
  2. Wait for or lure a victim to invoke virtualenv creation against that directory without --clear
  3. Observe deletion of files referenced by the malicious metadata during the PipInstall cleanup phase

How to detect it

Review file-system audit logs and process creation events around virtualenv invocations for unexpected deletions outside known environment paths; correlate with timestamps of environment creation commands.

What your security team should do

  • Immediately upgrade all virtualenv installations to 21.14.9
  • Add virtualenv version checks to CI/CD and developer onboarding pipelines
  • Scan for and remove legacy reused environment directories that predate the fix
  • Educate developers to always use --clear when recreating environments in shared locations

The record

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities