CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113718

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

DEBIAN-CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

DEBIAN-CVE-2026-113715

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

AZL-110094 CVE-2026-113716 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

AZL-110109 CVE-2026-113715 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

CVE-2026-113715

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113715

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

CVE-2026-113717

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

UBUNTU-CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

UBUNTU-CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

UBUNTU-CVE-2026-113720

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113720

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

UBUNTU-CVE-2026-113718

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

UBUNTU-CVE-2026-113724

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...