PyPA virtualenv EUVD-2026-105300

Exploitation requires a virtualenv run that reuses a destination already containing distribution metadata influenced by another account, where that metadata's top_level.txt or RECORD entries use relative traversal, absolute paths, or symlinked parent directories pointing outside the environment, AND the invoking user must hold deletion rights over those named paths. The destructive cleanup runs only during environment creation/reseeding before use. Key limiting factors: fresh environments with no pre-existing package metadata are NOT affected, creation with --clear bypasses the vulnerable cleanup path, the attacker needs a prior foothold to plant the metadata (local, low-privilege), and damage is bounded to files the invoking user can already delete.

This is a genuinely low-to-moderate priority issue, not a high-urgency flaw. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, base 4.5 MEDIUM) is internally consistent with the description: exploitation is local, requires low privileges, and carries high attack complexity because the attacker must have already influenced seed-package metadata in a destination that virtualenv later reuses. There is no EPSS score, KEV listing, or POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is a theoretical/targeted multi-user abuse case rather than a widespread remote threat. The one point worth flagging is impact mapping: the described harm is file DELETION outside the environment, which is an integrity/availability effect; the vendor-supplied vector's C:L (confidentiality) is questionable since no information disclosure is described. Overall the real-world risk is constrained to shared/multi-tenant hosts where one account can seed metadata consumed by another account's virtualenv run.

On a shared host, a lower-trust user plants distribution metadata (top_level.txt or RECORD entries using relative traversal, absolute paths, or symlinked parents) in an app-data seed location or reusable destination. When a higher-value user later creates or reseeds a virtualenv that reuses that destination, virtualenv's PipInstall._uninstall_previous_version() cleanup deletes the attacker-named paths with the invoking user's permissions, destroying files outside the environment. No public exploit code is identified, and the high attack complexity reflects the required pre-positioning of malicious metadata.