CVE-2026-102937

A flaw was found in virtualenv. An attacker can achieve arbitrary code execution by supplying specially crafted prompt values or environment configurations containing unescaped quote characters when generating Windows virtual environments. When a user executes the resulting activation script, the...

PT-2026-105683

These are all security issues fixed in the python313-virtualenv-21.14.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11974-1 python313-virtualenv-21.14.2-1.1 on GA media

These are all security issues fixed in the python313-virtualenv-21.14.2-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

SUSE CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

SUSE CVE-2026-102937

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

SUSE CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

aeso-mcp (>=0.2.0, <=0.3.0), aia-read-svc (>=0.5.1, <=0.6.2) +468 more potentially affected by CVE-2026-102925 via virtualenv (20.39.1)

virtualenv PYPI version 20.39.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aeso-mcp =0.2.0, =0.5.1, =2023.2.21, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.2.1, =0.2.1, =0.6.4, =0.2.0rc3, =0.1.0, =0.1.8 - api-buddy 0.5.0...

nova-prompt-optimizer (>=1.0.48, <=1.1.0), pkg-15903 (>=0.1.20, <=0.1.55) +9 more potentially affected by CVE-2026-102925 via virtualenv (20.31.2)

virtualenv PYPI version 20.31.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - nova-prompt-optimizer =1.0.48, =0.1.20, =0.1.1, =0.1.0, =1.0.0, =0.4.9, =0.5.3 Source cves: CVE-2026-102925 Source advisory:...

gllm-core-binary (>=0.0.0.dev0, <=0.4.4b3), hmd-cli-repo (>=0.3.149, <=0.3.165) +4 more potentially affected by CVE-2026-102925 via virtualenv (20.30.0)

virtualenv PYPI version 20.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - gllm-core-binary =0.0.0.dev0, =0.3.149, =0.1.0, =1.0.51, =0.4.4, =0.4.8 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-M...

pkg-15903 (>=0.1.10, <=0.1.18), py-package-updater (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2026-102925 via virtualenv (20.29.3)

virtualenv PYPI version 20.29.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pkg-15903 =0.1.10, =0.1.1, =0.1.1, =1.0.9 - ten8t 0.0.22 - tidyfiles 0.6.3 Source cves: CVE-2026-102925 Source advisory:...

allora-sdk (>=0.1.0, <=0.2.3), coinbase-agentkit (>=0.1.7.dev202503141, <=0.6.0) +2 more potentially affected by CVE-2026-102925 via virtualenv (20.28.1)

virtualenv PYPI version 20.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - allora-sdk =0.1.0, =0.1.7.dev202503141, =0.1.1.dev202503260, =0.1.1.dev202503260, =0.3.0 Source cves: CVE-2026-102925 Source advisory:...

pad-final-project (>=0.1.3, <=0.1.7), ppmanager (>=0.1.2, <=0.4.0) potentially affected by CVE-2026-102925 via virtualenv (20.28.0)

virtualenv PYPI version 20.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pad-final-project =0.1.3, =0.1.2, =0.4.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

aiap-model (0.0.0), getsome (0.1.1) +6 more potentially affected by CVE-2026-102925 via virtualenv (20.13.0)

virtualenv PYPI version 20.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aiap-model 0.0.0 - getsome 0.1.1 - invenio-cli =1.0.4, =0.0.1, =0.0.1, =0.17.0, =1.0.1.dev3, =0.0.1, =0.0.3 Source cves: CVE-2026-102925...

cinemator (0.1.3), gsy-frameworke (>=1.2.0, <=5.0.2) +1 more potentially affected by CVE-2026-102925 via virtualenv (20.10.0)

virtualenv PYPI version 20.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cinemator 0.1.3 - gsy-frameworke =1.2.0, =5.0.2 - limbo 8.6.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

chemscad (2.0.3), pcapprocessor (0.1.0) +3 more potentially affected by CVE-2026-102925 via virtualenv (20.8.1)

virtualenv PYPI version 20.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad 2.0.3 - pcapprocessor 0.1.0 - pickley =3.0.6, =0.0.9, =1.61.0, =1.66.4 Source cves: CVE-2026-102925 Source advisory:...

algo-crawler (>=0.0.1, <=0.0.2), omdenalore (0.2.10) +1 more potentially affected by CVE-2026-102925 via virtualenv (20.7.2)

virtualenv PYPI version 20.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - algo-crawler =0.0.1, =0.1.2, =0.1.3 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

pickley (3.0.5) potentially affected by CVE-2026-102925 via virtualenv (20.7.1)

virtualenv PYPI version 20.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pickley 3.0.5 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

aibro (>=1.0.9, <=1.1.5), cospy (>=0.4.0, <=0.4.2) potentially affected by CVE-2026-102925 via virtualenv (20.4.6)

virtualenv PYPI version 20.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aibro =1.0.9, =0.4.0, =0.4.2 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

ahead (>=0.1.0, <=0.6.0), pencil-pusher (>=1.2.0, <=1.6.0) potentially affected by CVE-2026-102925 via virtualenv (20.4.3)

virtualenv PYPI version 20.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ahead =0.1.0, =1.2.0, =1.6.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...