azure-devops-artifacts-helpers (1.0.7) potentially affected by CVE-2026-102937 via virtualenv (20.2.1)

virtualenv PYPI version 20.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers 1.0.7 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

awsegy (0.1.4), azure-devops-artifacts-helpers (>=0.0.1, <=1.0.6) +1 more potentially affected by CVE-2026-102937 via virtualenv (20.1.0)

virtualenv PYPI version 20.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - awsegy 0.1.4 - azure-devops-artifacts-helpers =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

chemscad (>=2.0.1.post4, <=2.0.2) potentially affected by CVE-2026-102937 via virtualenv (20.0.31)

virtualenv PYPI version 20.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad =2.0.1.post4, =2.0.2 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

pytoil (0.36.0), team13hackertype (>=1.0.1, <=1.0.4) potentially affected by CVE-2026-102937 via virtualenv (20.16.6)

virtualenv PYPI version 20.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pytoil 0.36.0 - team13hackertype =1.0.1, =1.0.4 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

pattooshared (>=0.0.95, <=0.0.120) potentially affected by CVE-2026-102937 via virtualenv (20.0.30)

virtualenv PYPI version 20.0.30 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pattooshared =0.0.95, =0.0.120 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

mlproto (>=0.1.1, <=0.2.0) potentially affected by CVE-2026-102937 via virtualenv (20.0.27)

virtualenv PYPI version 20.0.27 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - mlproto =0.1.1, =0.2.0 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

lftools (>=0.31.3, <=0.33.1), nerblackbox (0.0.5) potentially affected by CVE-2026-102937 via virtualenv (20.0.25)

virtualenv PYPI version 20.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - lftools =0.31.3, =0.33.1 - nerblackbox 0.0.5 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

showenv (>=0.1.0, <=2.0.0) potentially affected by CVE-2026-102937 via virtualenv (20.0.23)

virtualenv PYPI version 20.0.23 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - showenv =0.1.0, =2.0.0 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

bitdust-p2p (>=0.0.2, <=0.0.3), dweather-client (>=1.1.0, <=1.3.0) +1 more potentially affected by CVE-2026-102937 via virtualenv (20.0.21)

virtualenv PYPI version 20.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bitdust-p2p =0.0.2, =1.1.0, =0.2.3, =0.2.5 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

gllm-core-binary (>=0.0.0.dev0, <=0.4.4b3), gllm-inference-binary (0.5.51b3) +5 more potentially affected by CVE-2026-102937 via virtualenv (20.30.0)

virtualenv PYPI version 20.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - gllm-core-binary =0.0.0.dev0, =0.3.149, =0.1.0, =1.0.51, =0.4.4, =0.4.8 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3...

b1ddi (0.0.2), delete-branches (>=1.0.0, <=1.1.3) +15 more potentially affected by CVE-2026-102937 via virtualenv (20.34.0)

virtualenv PYPI version 20.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - b1ddi 0.0.2 - delete-branches =1.0.0, =1.1.14, =1.0.0, =1.1.0, =1.17.0, =1.25.0 and more Source cves: CVE-2026-102937 Source advisory:...

waldiez-runner (0.5.9) potentially affected by CVE-2026-102937 via virtualenv (20.33.0)

virtualenv PYPI version 20.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - waldiez-runner 0.5.9 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-102937 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-102937 Source advisory:...

nova-prompt-optimizer (>=1.0.48, <=1.1.0), pkg-15903 (>=0.1.20, <=0.1.55) +9 more potentially affected by CVE-2026-102937 via virtualenv (20.31.2)

virtualenv PYPI version 20.31.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - nova-prompt-optimizer =1.0.48, =0.1.20, =0.1.1, =0.1.0, =1.0.0, =0.4.9, =0.5.3 Source cves: CVE-2026-102937 Source advisory:...

delete-branches (1.2.14), delete-workflow-runs (1.2.32) +6 more potentially affected by CVE-2026-102937 via virtualenv (20.35.3)

virtualenv PYPI version 20.35.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.14 - delete-workflow-runs 1.2.32 - ironoc-pytest-conor-heffron =2.1.7, =2.2.0 - pkg-15903 0.1.100 - pkg-26548 1.3.32 -...

pkg-15903 (>=0.1.10, <=0.1.18), py-package-updater (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2026-102937 via virtualenv (20.29.3)

virtualenv PYPI version 20.29.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pkg-15903 =0.1.10, =0.1.1, =0.1.1, =1.0.9 - ten8t 0.0.22 - tidyfiles 0.6.3 Source cves: CVE-2026-102937 Source advisory:...

titanic-mieuxqaloys (0.1.0) potentially affected by CVE-2026-102937 via virtualenv (20.29.2)

virtualenv PYPI version 20.29.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - titanic-mieuxqaloys 0.1.0 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

pokpok-sdk (>=0.1.3, <=0.1.6) potentially affected by CVE-2026-102937 via virtualenv (20.29.1)

virtualenv PYPI version 20.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pokpok-sdk =0.1.3, =0.1.6 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

GHSA-X78J-V8H9-3J2Q virtualenv: Command injection via --prompt in activate.bat (batch activator)

BatchActivator.quote returned its input unchanged, the only activator with no escaping at all. --prompt, the VIRTUALENVPROMPT environment variable, and the config file all set the prompt, and activate.bat writes it straight into @set "VAR=value". A prompt containing a double quote closes that...

virtualenv: Command injection via --prompt in activate.bat (batch activator)

BatchActivator.quote returned its input unchanged, the only activator with no escaping at all. --prompt, the VIRTUALENVPROMPT environment variable, and the config file all set the prompt, and activate.bat writes it straight into @set "VAR=value". A prompt containing a double quote closes that...