alice-ci (>=0.0.2, <=0.0.9), pickley (3.1.6) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.14.0)

virtualenv PYPI version 20.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - alice-ci =0.0.2, =0.0.9 - pickley 3.1.6 - pytoil 0.29.0 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

cloudmesh-client (4.2.6) potentially affected by CVE-2026-102938 via virtualenv (15.0.1)

virtualenv PYPI version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cloudmesh-client 4.2.6 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

EUVD-2026-89465

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection...

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Summary pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write wrote values verbatim, while PyEnvCfg.readvalues parses the file with str.splitlines. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected...

allora-sdk (>=0.1.0, <=0.2.3), coinbase-agentkit (>=0.1.7.dev202503141, <=0.6.0) +2 more potentially affected by CVE-2026-102938 via virtualenv (20.28.1)

virtualenv PYPI version 20.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - allora-sdk =0.1.0, =0.1.7.dev202503141, =0.1.1.dev202503260, =0.1.1.dev202503260, =0.3.0 Source cves: CVE-2026-102938 Source advisory:...

limbo (8.6.1), python-thingiverse (>=0.0.6rc1.dev0, <=0.0.7.dev0) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.13.1)

virtualenv PYPI version 20.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - limbo 8.6.1 - python-thingiverse =0.0.6rc1.dev0, =0.26.0, =0.26.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

c2cciutils (>=1.1.47, <=1.1.58), dai-python-commons (5.4.16) +4 more potentially affected by CVE-2026-102938 via virtualenv (20.26.6)

virtualenv PYPI version 20.26.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - c2cciutils =1.1.47, =0.20.0, =0.20.1 - rosettapy 0.2.3rc181.post1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

hatch (1.9.7) potentially affected by CVE-2026-102938 via virtualenv (20.25.3)

virtualenv PYPI version 20.25.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch 1.9.7 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

automatic-spike-detection (>=1.0.0b0, <=1.2.4), snraspi-lib (1.0.6) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.24.4)

virtualenv PYPI version 20.24.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - automatic-spike-detection =1.0.0b0, =5.0.0, =5.0.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

pip-faster (>=1.0.0rc1, <=1.0.0rc6.dev4) potentially affected by CVE-2026-102938 via virtualenv (1.11.6)

virtualenv PYPI version 1.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pip-faster =1.0.0rc1, =1.0.0rc6.dev4 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

showenv (>=0.1.0, <=2.0.0) potentially affected by CVE-2026-102938 via virtualenv (20.0.23)

virtualenv PYPI version 20.0.23 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - showenv =0.1.0, =2.0.0 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

ezflow (>=0.2.1, <=0.2.4) potentially affected by CVE-2026-102938 via virtualenv (20.5.0)

virtualenv PYPI version 20.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ezflow =0.2.1, =0.2.4 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

aprsd (>=1.5.0, <=1.5.1), ttp-sros-parser (>=0.0.1, <=0.1.4) potentially affected by CVE-2026-102938 via virtualenv (20.2.2)

virtualenv PYPI version 20.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aprsd =1.5.0, =0.0.1, =0.1.4 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

chemscad (>=2.0.1.post4, <=2.0.2) potentially affected by CVE-2026-102938 via virtualenv (20.0.31)

virtualenv PYPI version 20.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad =2.0.1.post4, =2.0.2 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

c2cciutils (>=1.1.16, <=1.1.46), crl-devutils (>=1.3.1, <=1.4.0) potentially affected by CVE-2026-102938 via virtualenv (20.13.4)

virtualenv PYPI version 20.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - c2cciutils =1.1.16, =1.3.1, =1.4.0 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

ciscoconfparse (>=1.6.53, <=1.7.3), pytoil (0.37.0) potentially affected by CVE-2026-102938 via virtualenv (20.16.7)

virtualenv PYPI version 20.16.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ciscoconfparse =1.6.53, =1.7.3 - pytoil 0.37.0 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

bitdust-p2p (>=0.0.2, <=0.0.3), dweather-client (>=1.1.0, <=1.3.0) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.0.21)

virtualenv PYPI version 20.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bitdust-p2p =0.0.2, =1.1.0, =0.2.3, =0.2.5 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

pad-final-project (>=0.1.3, <=0.1.7), ppmanager (>=0.1.2, <=0.4.0) potentially affected by CVE-2026-102938 via virtualenv (20.28.0)

virtualenv PYPI version 20.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pad-final-project =0.1.3, =0.1.2, =0.4.0 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

uranium (>=0.2.8, <=0.2.22) potentially affected by CVE-2026-102938 via virtualenv (13.1.0)

virtualenv PYPI version 13.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - uranium =0.2.8, =0.2.22 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

dai-python-commons (>=5.4.17, <=5.4.18), foundation-cancer-image-biomarker (>=1.0.1a4, <=1.0.1a5) +6 more potentially affected by CVE-2026-102938 via virtualenv (20.27.1)

virtualenv PYPI version 20.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dai-python-commons =5.4.17, =1.0.1a4, =0.1.0, =0.1.1, =0.1.0, =0.1.3 - python-rektor-monitor 0.1.1 - pyxote 0.1.0 Source cves:...