CVE-2026-113719: virtualenv: Seed replacement does not contain metadata deletion paths
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment.
Anthropic’s OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026.
References
- github.com/advisories/GHSA-hhxq-47xx-j5xx
- github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f
- github.com/pypa/virtualenv/pull/3428
- github.com/pypa/virtualenv/releases/tag/21.14.9
- github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx
- nvd.nist.gov/vuln/detail/CVE-2026-113719
Code Behaviors & Features
Detect and mitigate CVE-2026-113719 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →