ROOT-APP-PYPI-CVE-2026-102937 CVE-2026-102937 in virtualenv - Patched by Root

Root has patched CVE-2026-102937 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-102925 CVE-2026-102925 in virtualenv - Patched by Root

Root has patched CVE-2026-102925 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-102930 CVE-2026-102930 in virtualenv - Patched by Root

Root has patched CVE-2026-102930 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-22702 CVE-2026-22702 in virtualenv - Patched by Root

Root has patched CVE-2026-22702 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

PT-2026-118624

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description In POSIX xonsh activation, the quote function uses repr to write non-ASCII prompt or destination data into the UTF-8 activate.xsh script. When xonsh reads this script using $XONSH ENCODING under...

PT-2026-118629

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description Caller-supplied prompt text can be converted into executable syntax within the bash activation prompt. This occurs when an attacker influences the value passed to the tool, and a user subsequent...

python36:3.6 security update

python36 3.6.8-39 - Provide /usr/bin/python3 explicitly - Resolves: RHEL-2113 python-distro 1.4.0-2 - Port from Fedora to RHEL8, part of the python36 module - Resolves: rhbz1678920 python-docs 3.6.7-2 - Bumping due to problems with modular RPM upgrade path - Resolves: rhbz1695587 python-docutils...

SUSE SLED15 / SLES15 Security Update : python-virtualenv (SUSE-SU-2026:4652-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4652-1 advisory. - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. ...

Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890. Patch Instruction...

SUSE-SU-2026:4652-1 Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890...

CVE-2026-102930 affecting package python-virtualenv for versions less than 20.36.1-7

CVE-2026-102930 affecting package python-virtualenv for versions less than 20.36.1-7. A patched version of the package is available...

CVE-2026-102925 affecting package python-virtualenv for versions less than 20.36.1-7

CVE-2026-102925 affecting package python-virtualenv for versions less than 20.36.1-7. A patched version of the package is available...

python313-virtualenv-21.14.2-1.1 on GA media (moderate)

python313-virtualenv-21.14.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11974-1 Rating: moderate Cross-References: CVE-2024-9287 CVE-2026-102925 CVE-2026-102930 CVE-2026-102938 CVSS scores: CVE-2024-9287 SUSE : 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H CVE-2024-9287 SUSE : 5.3...

CLSA-2026-1791452380 TuxCare security update for virtualenv (4 CVEs)

TuxCare rebuilt virtualenv to address 4 CVEs. Fixed in 20.39.1.post2+tuxcare...

ROOT-APP-PYPI-AIKIDO-2026-785880 AIKIDO-2026-785880 in virtualenv - Patched by Root

Root has patched AIKIDO-2026-785880 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-AIKIDO-2026-674766 AIKIDO-2026-674766 in virtualenv - Patched by Root

Root has patched AIKIDO-2026-674766 in the virtualenv package for Root:PyPI. Multiple fixed versions available...

BIT-VIRTUALENV-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

BIT-VIRTUALENV-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

BIT-VIRTUALENV-2026-102930 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

BIT-VIRTUALENV-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...