SUSE SLED15 / SLES15 Security Update : python-virtualenv (SUSE-SU-2026:4652-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4652-1 advisory. - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. ...

SUSE-SU-2026:24243-1 Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890...

OPENSUSE-SU-2026:22100-1 Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890...

Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890. Patch Instruction...

SUSE-SU-2026:4652-1 Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890...

CVE-2026-102925 affecting package python-virtualenv for versions less than 20.36.1-7

CVE-2026-102925 affecting package python-virtualenv for versions less than 20.36.1-7. A patched version of the package is available...

CVE-2026-102930 affecting package python-virtualenv for versions less than 20.36.1-7

CVE-2026-102930 affecting package python-virtualenv for versions less than 20.36.1-7. A patched version of the package is available...

PT-2026-118631

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.7 Description The bash activate script fails to properly escape the environment name during the two passes bash performs over the PS1 prompt variable. Consequently, a backslash in the environment name can und...

python313-virtualenv-21.14.2-1.1 on GA media (moderate)

python313-virtualenv-21.14.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11974-1 Rating: moderate Cross-References: CVE-2024-9287 CVE-2026-102925 CVE-2026-102930 CVE-2026-102938 CVSS scores: CVE-2024-9287 SUSE : 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H CVE-2024-9287 SUSE : 5.3...

CLSA-2026-1791452380 TuxCare security update for virtualenv (4 CVEs)

TuxCare rebuilt virtualenv to address 4 CVEs. Fixed in 20.39.1.post2+tuxcare...

PT-2026-117090

TuxCare rebuilt virtualenv to address 4 CVEs. Fixed in 20.39.1.post2+tuxcare...

ROOT-APP-PYPI-AIKIDO-2026-674766 AIKIDO-2026-674766 in virtualenv - Patched by Root

Root has patched AIKIDO-2026-674766 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-AIKIDO-2026-785880 AIKIDO-2026-785880 in virtualenv - Patched by Root

Root has patched AIKIDO-2026-785880 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

PT-2026-116448

Root has patched AIKIDO-2026-674766 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

PT-2026-116449

Root has patched AIKIDO-2026-785880 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

BIT-VIRTUALENV-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

BIT-VIRTUALENV-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

BIT-VIRTUALENV-2026-102930 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

BIT-VIRTUALENV-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

CVE-2026-102937

A flaw was found in virtualenv. An attacker can achieve arbitrary code execution by supplying specially crafted prompt values or environment configurations containing unescaped quote characters when generating Windows virtual environments. When a user executes the resulting activation script, the...