virtualenv: Seed replacement does not contain metadata deletion paths

影響: pip:virtualenv < 21.14.9 → 21.14.9

The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026. Affected area Removal of a previously installed seed package. Attacker-controlled input An environment being reused must contain distribution metadata influenced by another account. The invoking user must have del…

在 GitHub Advisory Database 阅读

2026/10/24 07:19，GitHub Advisory Database 发布了“virtualenv: Seed replacement does not contain metadata deletion paths”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-113719。