virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9,
    PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist()
    joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused
    destination contains distribution metadata influenced by another account, relative traversal, absolute
    entries, or linked parents can cause app-data reseeding to delete files outside the environment or the
    environment root with the invoking user's permissions, provided that user has deletion rights over the
    named paths. The deletion occurs during environment creation before any later use of the environment.
    Fresh environments without existing package metadata and creation with --clear do not enter this cleanup
    path. This issue is fixed in version 21.14.9. (CVE-2026-113719)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9,     PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist()     joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused     destination contains distribution metadata influenced by another account, relative traversal, absolute     entries, or linked parents can cause app-data reseeding to delete files outside the environment or the     environment root with the invoking user's permissions, provided that user has deletion rights over the     named paths. The deletion occurs during environment creation before any later use of the environment.
    Fresh environments without existing package metadata and creation with --clear do not enter this cleanup     path. This issue is fixed in version 21.14.9. (CVE-2026-113719)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477224	SCA: security update for virtualenv (GHSA-hhxq-47xx-j5xx)	Tenable Cloud Security	SCA Checks	Local	medium
477224	SCA: security update for virtualenv (GHSA-hhxq-47xx-j5xx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
370950	Linux Distros Unpatched Vulnerability : CVE-2026-113719	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-113719

medium

Tenable Plugins

medium

medium

medium