virtualenv: Seed replacement does not contain metadata deletion paths

Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026...

pkg-15903 (>=0.1.10, <=0.1.18), py-package-updater (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2026-113719 via virtualenv (20.29.3)

virtualenv PYPI version 20.29.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pkg-15903 =0.1.10, =0.1.1, =0.1.1, =1.0.9 - ten8t 0.0.22 - tidyfiles 0.6.3 Source cves: CVE-2026-113719 Source advisory:...

azure-devops-artifacts-helpers (1.0.10), deepof (>=0.1.8, <=0.1.85) +7 more potentially affected by CVE-2026-113719 via virtualenv (20.14.1)

virtualenv PYPI version 20.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers 1.0.10 - deepof =0.1.8, =0.1.5, =0.30.0, =0.0.3, =1.0.1, =0.0.4, =0.3.0, =0.4.6 Source cves: CVE-2026-11371...

gllm-core-binary (>=0.0.0.dev0, <=0.4.4b3), hmd-cli-repo (>=0.3.149, <=0.3.165) +4 more potentially affected by CVE-2026-113719 via virtualenv (20.30.0)

virtualenv PYPI version 20.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - gllm-core-binary =0.0.0.dev0, =0.3.149, =0.1.0, =1.0.51, =0.4.4, =0.4.8 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J...

optimizo (>=1.2.0, <=1.3.0), pencil-pusher (1.6.1) potentially affected by CVE-2026-113719 via virtualenv (20.4.7)

virtualenv PYPI version 20.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - optimizo =1.2.0, =1.3.0 - pencil-pusher 1.6.1 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

akc-mamba (>=2.0.1, <=2.0.2), pangsitpy (0.0.3) potentially affected by CVE-2026-113719 via virtualenv (16.7.9)

virtualenv PYPI version 16.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - akc-mamba =2.0.1, =2.0.2 - pangsitpy 0.0.3 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

ahead (>=0.1.0, <=0.6.0), pencil-pusher (>=1.2.0, <=1.6.0) potentially affected by CVE-2026-113719 via virtualenv (20.4.3)

virtualenv PYPI version 20.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ahead =0.1.0, =1.2.0, =1.6.0 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

aieng-platform-onboard (>=0.5.0, <=0.7.5), autodocgenerator (>=0.5.1, <=1.6.6.8) +10 more potentially affected by CVE-2026-113719 via virtualenv (20.36.1)

virtualenv PYPI version 20.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aieng-platform-onboard =0.5.0, =0.5.1, =1.1.0.dev20260322010408, =0.0.0, =2.2.9, =0.5.0, =1.0.0, =1.0.0b2, =1.1.0, =1.2.0 - waldiez-runner...

showenv (>=0.1.0, <=2.0.0) potentially affected by CVE-2026-113719 via virtualenv (20.0.23)

virtualenv PYPI version 20.0.23 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - showenv =0.1.0, =2.0.0 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

dai-python-commons (>=5.4.17, <=5.4.18), foundation-cancer-image-biomarker (>=1.0.1a4, <=1.0.1a5) +6 more potentially affected by CVE-2026-113719 via virtualenv (20.27.1)

virtualenv PYPI version 20.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dai-python-commons =5.4.17, =1.0.1a4, =0.1.0, =0.1.1, =0.1.0, =0.1.3 - python-rektor-monitor 0.1.1 - pyxote 0.1.0 Source cves:...

pip-faster (>=1.0.0rc1, <=1.0.0rc6.dev4) potentially affected by CVE-2026-113719 via virtualenv (1.11.6)

virtualenv PYPI version 1.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pip-faster =1.0.0rc1, =1.0.0rc6.dev4 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

aprsd (1.6.0), costsekondi (0.0.1) potentially affected by CVE-2026-113719 via virtualenv (20.4.0)

virtualenv PYPI version 20.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aprsd 1.6.0 - costsekondi 0.0.1 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

debpackager (>=0.1.0, <=0.2.1), scriptworker (0.2.1) +1 more potentially affected by CVE-2026-113719 via virtualenv (15.0.2)

virtualenv PYPI version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - debpackager =0.1.0, =0.2.35, =1.1.0 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113719 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

dcoscli (>=0.1.9, <=0.4.6), python-mu (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-113719 via virtualenv (13.1.2)

virtualenv PYPI version 13.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.9, =1.0.1, =0.2.23, =0.2.34 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

buildpan (>=0.0.12, <=0.0.22), buildpan-cli (1.0.0) +6 more potentially affected by CVE-2026-113719 via virtualenv (20.6.0)

virtualenv PYPI version 20.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - buildpan =0.0.12, =0.1.0, =0.0.0, =0.0.1, =0.0.1, =3.0.2, =3.0.4 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

awsegy (0.1.4), azure-devops-artifacts-helpers (>=0.0.1, <=1.0.6) +1 more potentially affected by CVE-2026-113719 via virtualenv (20.1.0)

virtualenv PYPI version 20.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - awsegy 0.1.4 - azure-devops-artifacts-helpers =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

delete-branches (1.2.15), delete-workflow-runs (1.2.33) +12 more potentially affected by CVE-2026-113719 via virtualenv (20.35.4)

virtualenv PYPI version 20.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.15 - delete-workflow-runs 1.2.33 - elroy =0.0.62, =0.0.1b1, =0.6.0, =2.2.1, =6.0.0, =1.2.3, =0.6.2, =0.7.0 Source cves...

b1ddi (0.0.2), delete-branches (>=1.0.0, <=1.1.3) +15 more potentially affected by CVE-2026-113719 via virtualenv (20.34.0)

virtualenv PYPI version 20.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - b1ddi 0.0.2 - delete-branches =1.0.0, =1.1.14, =1.0.0, =1.1.0, =1.17.0, =1.25.0 and more Source cves: CVE-2026-113719 Source advisory:...

hatch (1.9.7) potentially affected by CVE-2026-113719 via virtualenv (20.25.3)

virtualenv PYPI version 20.25.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch 1.9.7 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...