CVE-2026-113718

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

agentics-py (>=0.0.7, <=0.3.6), agentis (>=1.2.6, <=1.2.7) +199 more potentially affected by CVE-2026-113718 via virtualenv (>=21.3.1, <=21.14.5)

virtualenv PYPI version =21.3.1, =0.0.7, =1.2.6, =0.1.68, =0.1.0, =0.1.0, =0.5.0b2, =1.1.0a20250429, =0.0.3, =0.0.1a0, =0.1.1b20230324, =1.0.1b20240405, =1.0.1b20240405, =1.0.21, =0.2.40, =0.2.70 and more Source cves: CVE-2026-113718 Source advisory: MEND:CVE-2026-113718...

CVE-2026-113718 virtualenv: Xonsh activation literals depend on the script decoding codec

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the quote method in src/virtualenv/activation/xonsh/init.py, which uses repr to encode string literals written into the xonsh activation script. Because repr does not guarantee ASCII-safe output, non-ASCII...

CVE-2026-113718

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

CVE-2026-113718 virtualenv: Xonsh activation literals depend on the script decoding codec

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

CVE-2026-113717

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

agentics-py (>=0.0.7, <=0.3.6), agentis (>=1.2.6, <=1.2.7) +193 more potentially affected by CVE-2026-113717 via virtualenv (>=21.7.13, <=21.14.5)

virtualenv PYPI version =21.7.13, =0.0.7, =1.2.6, =0.1.68, =0.1.0, =0.1.0, =0.5.0b2, =1.1.0a20250429, =0.0.3, =0.0.1a0, =0.1.1b20230324, =1.0.1b20240405, =1.0.1b20240405, =1.0.21, =0.2.40, =0.2.70 and more Source cves: CVE-2026-113717 Source advisory: MEND:CVE-2026-113717...

CVE-2026-113717 virtualenv: Pip seeding with download omits wheel digest verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113717

The virtualenv tool for creating isolated Python environments is vulnerable to a digest verification bypass in versions prior to 21.14.9 . The root cause lies in the PipInvoke.get_pip_install_cmd() function, which handles --seeder pip --download by calling get_wheel(download=False). This allows p...

CVE-2026-113717 virtualenv: Pip seeding with download omits wheel digest verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113717 virtualenv: Pip seeding with download omits wheel digest verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113717

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716

The virtualenv tool, prior to version 21.14.9 , is vulnerable to a symlink following issue during builtin environment creation. The ensure_dir() function improperly follows existing symlinks for executable, library, and package directories. If a local attacker prepares a tree containing a symlink...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

agentics-py (>=0.0.7, <=0.3.6), agentis (>=1.2.6, <=1.2.7) +202 more potentially affected by CVE-2026-113716 via virtualenv (>=21.1.0, <=21.14.5)

virtualenv PYPI version =21.1.0, =0.0.7, =1.2.6, =0.1.68, =0.1.0, =0.1.0, =0.5.0b2, =1.1.0a20250429, =0.0.3, =0.0.1a0, =0.1.1b20230324, =1.0.1b20240405, =1.0.1b20240405, =1.0.21, =0.2.40, =0.2.70 and more Source cves: CVE-2026-113716 Source advisory: MEND:CVE-2026-113716...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...