virtualenv: Seed replacement does not contain metadata deletion paths
影響: pip:virtualenv < 21.14.9 → 21.14.9
The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026. Affected area Removal of a previously installed seed package. Attacker-controlled input An environment being reused must contain distribution metadata influenced by another account. The invoking user must have del…
| CVE | CVE-2026-113719 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/24 13:50 |
| データ | Markdown JSON |
2026/10/24 07:19、GitHub Advisory Databaseが「virtualenv: Seed replacement does not contain metadata deletion paths」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-113719。