Linux Distros Unpatched Vulnerability : CVE-2026-113724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by...

Linux Distros Unpatched Vulnerability : CVE-2026-113726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment...

CVE-2026-113715

virtualenv is a tool for creating isolated virtual python environments...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments...

CVE-2026-113718

virtualenv is a tool for creating isolated virtual python environments...

CVE-2026-113732

virtualenv is a tool for creating isolated virtual python environments...

Linux Distros Unpatched Vulnerability : CVE-2026-113720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files...

Linux Distros Unpatched Vulnerability : CVE-2026-113718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII...

Linux Distros Unpatched Vulnerability : CVE-2026-113725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of...

Linux Distros Unpatched Vulnerability : CVE-2026-113713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to...

Linux Distros Unpatched Vulnerability : CVE-2026-113715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines...

CVE-2026-113725

virtualenv is a tool for creating isolated virtual python environments...

EUVD-2026-105303

virtualenv: Generated files can follow existing destination links...

GHSA-558C-9HV2-4PRJ virtualenv: Generated files can follow existing destination links

Summary Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported...

virtualenv: Generated files can follow existing destination links

Summary Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environment. The template writer tests exists before unlinking, which misses dangling symlinks; the configuration writer opens the existing path directly. Anthropic's OSS Scanner reported...

CLSA-2026-1792653259 TuxCare security update for virtualenv (1 CVE)

TuxCare rebuilt virtualenv to address 1 CVE. Fixed in 20.39.1.post4+tuxcare...

virtualenv Arbitrary Command Execution

The vulnerability of the tool for creating isolated virtual environments in Python virtualenv is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

activate.sh Arbitrary Command Execution

The vulnerability in the activate.sh script src/virtualenv/activation/bash/activate.sh, a tool for creating isolated virtual environments in Python virtualenv, is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability could allow an attacker to...

Virtualenv Bash Activate Runs Commands From An Environment Name With A Backslash Before $

Summary The bash "activate" script escapes the environment name for only one of the two passes bash makes over "PS1", so a backslash in the name undoes the escaping and a name containing "$..." runs as commands in the user's shell each time bash draws the prompt. Affected area...

virtualenv: Builtin creation follows linked environment directories

Summary The builtin creator accepts existing directory symlinks through ensuredir and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15...