CVE-2026-113718

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

CVE-2026-113722

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer...

UBUNTU-CVE-2026-113725

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

UBUNTU-CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

UBUNTU-CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

UBUNTU-CVE-2026-113722

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer...

CVE-2026-113725

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

UBUNTU-CVE-2026-113717

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

UBUNTU-CVE-2026-113715

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

CVE-2026-113720

A flaw was found in virtualenv. When creating new environments, cached package files retain their original permissions rather than respecting the current user file-creation mask umask. On shared systems where an environment directory is accessible to other users, a local attacker can modify these...

CVE-2026-113719

A flaw was found in virtualenv. This vulnerability allows a local attacker to cause arbitrary file deletion outside the target environment directory. When creating an isolated environment in a reused directory, virtualenv processes existing package metadata during cleanup without verifying that...

CVE-2026-113718

A flaw was found in virtualenv. This vulnerability could lead to arbitrary code execution when a user sources a generated xonsh activation script. Under certain multibyte character encodings, improper quoting of non-ASCII directory paths or prompt strings allows quote boundaries to be broken...

CVE-2026-113717

A flaw was found in virtualenv. When creating an environment using the pip seeder with the download option, the tool bypasses its package digest verification routines. A remote attacker controlling a package index could exploit this flaw to provide modified package files without triggering expect...

CVE-2026-113716

A flaw was found in virtualenv. When creating an isolated environment, directory validation resolves existing symbolic links symlinks rather than verifying the intended target destination. A local attacker could exploit this vulnerability by pre-creating a directory tree containing symlinks...

CVE-2026-113715

A flaw was found in virtualenv. When creating virtual environments, the tool fails to properly sanitize destination pathnames containing line-breaking characters before processing configuration files. An attacker who influences the target path can exploit this flaw to inject unauthorized settings...

CVE-2026-113714

A flaw was found in virtualenv. The utility writes downloaded software packages directly into its reusable cache before completing integrity verification checks. An attacker controlling a package repository can exploit this flaw to retain rejected or manipulated packages in the cache, resulting i...

CVE-2026-113713

A flaw was found in virtualenv. When configured to link application data through environment variables or configuration files, virtualenv can leave newly created environments linked to temporary package files that are deleted after setup completes. Because the virtual environment references an...

agentics-py (>=0.0.7, <=0.3.6), agentis (>=1.2.6, <=1.2.7) +202 more potentially affected by CVE-2026-113725 via virtualenv (>=21.1.0, <=21.14.5)

virtualenv PYPI version =21.1.0, =0.0.7, =1.2.6, =0.1.68, =0.1.0, =0.1.0, =0.5.0b2, =1.1.0a20250429, =0.0.3, =0.0.1a0, =0.1.1b20230324, =1.0.1b20240405, =1.0.1b20240405, =1.0.21, =0.2.40, =0.2.70 and more Source cves: CVE-2026-113725 Source advisory: MEND:CVE-2026-113725...

CVE-2026-113725

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...