CVE-2026-113719

Status: Awaiting AnalysisMedium (4.5)—

Severity4.5Medium · CVSS 3.1

Exploitation probability0.12 %higher than 2% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment.

Read full descriptionShow less

When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

CVSS

Base score: 4.5
Version: 3.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.12 %
Percentile among all scored CVEs: 2
Score date: 10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation80 %
Primary impactT1485 Data Destructionimpact85 %

El vector AV:L/UI:N indica acceso local sin interacción; el texto describe borrado de archivos fuera del entorno (CWE-22) con los permisos del usuario que crea el entorno.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

User Account Management Threat Intelligence Program Multi-factor Authentication Execution Prevention Application Isolation and Sandboxing Exploit Protection

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Pypa — Virtualenv^AI

CWEs

CWE-22

References

Show 4 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-113719",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pypa",
          "product": "virtualenv",
          "versions": [
            {
              "status": "affected",
              "version": "< 21.14.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T20:17:18.347",
  "references": [
    {
      "url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pypa/virtualenv/pull/3428",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9."
    }
  ],
  "lastModified": "2026-10-22T16:47:38.403",
  "sourceIdentifier": "security-advisories@github.com"
}