pickley (3.0.5) potentially affected by CVE-2026-102925 via virtualenv (20.7.1)

virtualenv PYPI version 20.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pickley 3.0.5 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

buildpan (>=0.0.12, <=0.0.22), buildpan-cli (1.0.0) +6 more potentially affected by CVE-2026-102925 via virtualenv (20.6.0)

virtualenv PYPI version 20.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - buildpan =0.0.12, =0.1.0, =0.0.0, =0.0.1, =0.0.1, =3.0.2, =3.0.4 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

lftools (0.31.2) potentially affected by CVE-2026-102925 via virtualenv (20.0.9)

virtualenv PYPI version 20.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - lftools 0.31.2 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

lst-pressure (1.8.5) potentially affected by CVE-2026-102925 via virtualenv (20.26.4)

virtualenv PYPI version 20.26.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - lst-pressure 1.8.5 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-102925 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-102925 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

delete-branches (1.2.14), delete-workflow-runs (1.2.32) +6 more potentially affected by CVE-2026-102925 via virtualenv (20.35.3)

virtualenv PYPI version 20.35.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.14 - delete-workflow-runs 1.2.32 - ironoc-pytest-conor-heffron =2.1.7, =2.2.0 - pkg-15903 0.1.100 - pkg-26548 1.3.32 -...

hatch (>=1.0.0rc2, <=1.0.0rc8) potentially affected by CVE-2026-102925 via virtualenv (20.11.2)

virtualenv PYPI version 20.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch =1.0.0rc2, =1.0.0rc8 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

cinemator (0.1.3), gsy-frameworke (>=1.2.0, <=5.0.2) +1 more potentially affected by CVE-2026-102925 via virtualenv (20.10.0)

virtualenv PYPI version 20.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cinemator 0.1.3 - gsy-frameworke =1.2.0, =5.0.2 - limbo 8.6.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

sym-sdk (>=0.0.1, <=0.0.22) potentially affected by CVE-2026-102925 via virtualenv (20.4.1)

virtualenv PYPI version 20.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - sym-sdk =0.0.1, =0.0.22 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102925 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

distill-trainer (>=0.1.0, <=0.1.1), edx-repo-tools (>=0.7.4, <=0.8.1) +4 more potentially affected by CVE-2026-102925 via virtualenv (20.23.0)

virtualenv PYPI version 20.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - distill-trainer =0.1.0, =0.7.4, =1.0.0b4, =1.0.1 - pytoil 0.38.2 - wolf-core 2.0.1 Source cves: CVE-2026-102925 Source advisory:...

EUVD-2026-89461

virtualenv bash and fish activation scripts execute commands embedded in paths...

GHSA-P58F-9548-MPM2 virtualenv bash and fish activation scripts execute commands embedded in paths

Impact The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs comman...

algo-crawler (>=0.0.1, <=0.0.2), omdenalore (0.2.10) +1 more potentially affected by CVE-2026-102925 via virtualenv (20.7.2)

virtualenv PYPI version 20.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - algo-crawler =0.0.1, =0.1.2, =0.1.3 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

akc-mamba (>=2.0.1, <=2.0.2), pangsitpy (0.0.3) potentially affected by CVE-2026-102925 via virtualenv (16.7.9)

virtualenv PYPI version 16.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - akc-mamba =2.0.1, =2.0.2 - pangsitpy 0.0.3 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

b1ddi (0.0.2), delete-branches (>=1.0.0, <=1.1.3) +15 more potentially affected by CVE-2026-102925 via virtualenv (20.34.0)

virtualenv PYPI version 20.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - b1ddi 0.0.2 - delete-branches =1.0.0, =1.1.14, =1.0.0, =1.1.0, =1.17.0, =1.25.0 and more Source cves: CVE-2026-102925 Source advisory:...

bblib (>=0.1.1, <=3.1.0), beambusters (>=1.0.0, <=3.1.0) +7 more potentially affected by CVE-2026-102925 via virtualenv (20.25.1)

virtualenv PYPI version 20.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bblib =0.1.1, =1.0.0, =1.0.1, =0.8.4, =0.0.2, =0.0.1, =0.7.30, =1.0.0, =1.0.3, =1.0.8 Source cves: CVE-2026-102925 Source advisory:...

dreem (>=0.0.0, <=0.1.16), riot (>=0.17.2, <=0.18.0) potentially affected by CVE-2026-102925 via virtualenv (20.20.0)

virtualenv PYPI version 20.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dreem =0.0.0, =0.17.2, =0.18.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-102925 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...