{"id":"ghsa-ghsa-hhxq-47xx-j5xx","seq":661287,"kind":"advisory","title":"virtualenv: Seed replacement does not contain metadata deletion paths","url":"https://github.com/advisories/GHSA-hhxq-47xx-j5xx","permalink":"https://vulnpulse.app/items/ghsa-ghsa-hhxq-47xx-j5xx","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nThe app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026. Affected area Removal of a previously installed seed package. Attacker-controlled input An environment being reused must contain distribution metadata influenced by another account. The invoking user must have del…","severity":"medium","techs":["python"],"cves":["CVE-2026-113719"],"tags":["GHSA-hhxq-47xx-j5xx","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:19:15.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}