foxbms-fox-cli (1.12.0), ironoc-pytest-conor-heffron (>=2.3.4, <=2.5.1) +8 more potentially affected by CVE-2026-102937 via virtualenv (>=21.1.0, <=21.7.4)

virtualenv PYPI version =21.1.0, =2.3.4, =0.1.4, =0.1.0, =0.3.1, =0.0.3, =1.5.1, =1.1.0, =1.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-102937 Source advisory: GHSA-X78J-V8H9-3J2Q...

aeso-mcp (>=0.2.0, <=0.3.0), aia-read-svc (>=0.5.1, <=0.6.2) +468 more potentially affected by CVE-2026-102937 via virtualenv (20.39.1)

virtualenv PYPI version 20.39.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aeso-mcp =0.2.0, =0.5.1, =2023.2.21, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.2.1, =0.2.1, =0.6.4, =0.2.0rc3, =0.1.0, =0.1.8 - api-buddy 0.5.0...

aieng-platform-onboard (>=0.5.0, <=0.7.5), autodocgenerator (>=0.5.1, <=1.6.6.8) +10 more potentially affected by CVE-2026-102937 via virtualenv (20.36.1)

virtualenv PYPI version 20.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aieng-platform-onboard =0.5.0, =0.5.1, =1.1.0.dev20260322010408, =0.0.0, =2.2.9, =0.5.0, =1.0.0, =1.0.0b2, =1.1.0, =1.2.0 - waldiez-runner...

delete-branches (1.2.15), delete-workflow-runs (1.2.33) +12 more potentially affected by CVE-2026-102937 via virtualenv (20.35.4)

virtualenv PYPI version 20.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.15 - delete-workflow-runs 1.2.33 - elroy =0.0.62, =0.0.1b1, =0.6.0, =2.2.1, =6.0.0, =1.2.3, =0.6.2, =0.7.0 Source cves...

delete-branches (1.2.14), delete-workflow-runs (1.2.32) +6 more potentially affected by CVE-2026-102937 via virtualenv (20.35.3)

virtualenv PYPI version 20.35.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.14 - delete-workflow-runs 1.2.32 - ironoc-pytest-conor-heffron =2.1.7, =2.2.0 - pkg-15903 0.1.100 - pkg-26548 1.3.32 -...

GHSA-X78J-V8H9-3J2Q virtualenv: Command injection via --prompt in activate.bat (batch activator)

BatchActivator.quote returned its input unchanged, the only activator with no escaping at all. --prompt, the VIRTUALENVPROMPT environment variable, and the config file all set the prompt, and activate.bat writes it straight into @set "VAR=value". A prompt containing a double quote closes that...

python-webex-bot (0.51.0) potentially affected by CVE-2026-102937 via virtualenv (16.4.3)

virtualenv PYPI version 16.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - python-webex-bot 0.51.0 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

fzpycreate (>=0.0.12, <=2.0.0), neo-python (0.8.4) potentially affected by CVE-2026-102937 via virtualenv (16.2.0)

virtualenv PYPI version 16.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - fzpycreate =0.0.12, =2.0.0 - neo-python 0.8.4 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

pystarter (>=1.0.0, <=1.1.2), terraenv (>=0.6.0.dev0, <=0.6.2) potentially affected by CVE-2026-102937 via virtualenv (16.1.0)

virtualenv PYPI version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pystarter =1.0.0, =0.6.0.dev0, =0.6.2 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

cabrita (>=2.2.2b1, <=2.2.2b2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-102937 via virtualenv (16.0.0)

virtualenv PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cabrita =2.2.2b1, =0.7.8, =0.7.2, =1.7.2, =1.11.0 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-102937 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-102937 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

debpackager (>=0.1.0, <=0.2.1), scriptworker (0.2.1) +1 more potentially affected by CVE-2026-102937 via virtualenv (15.0.2)

virtualenv PYPI version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - debpackager =0.1.0, =0.2.35, =1.1.0 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

cloudmesh-client (4.2.6) potentially affected by CVE-2026-102937 via virtualenv (15.0.1)

virtualenv PYPI version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cloudmesh-client 4.2.6 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

dcoscli (>=0.1.1, <=0.1.8) potentially affected by CVE-2026-102937 via virtualenv (12.1.1)

virtualenv PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.1, =0.1.8 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

pip-faster (>=1.0.0rc1, <=1.0.0rc6.dev4) potentially affected by CVE-2026-102937 via virtualenv (1.11.6)

virtualenv PYPI version 1.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pip-faster =1.0.0rc1, =1.0.0rc6.dev4 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

lst-pressure (1.8.5) potentially affected by CVE-2026-102937 via virtualenv (20.26.4)

virtualenv PYPI version 20.26.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - lst-pressure 1.8.5 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

artistools (>=2024.7.4, <=2024.7.4.1), blkmrln (0.1.0) +10 more potentially affected by CVE-2026-102937 via virtualenv (20.26.3)

virtualenv PYPI version 20.26.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - artistools =2024.7.4, =2.0.0, =0.1.0, =0.1.9, =1.0.0, =3.0.0.0a0, =0.2.0, =1.0.0 Source cves: CVE-2026-102937 Source advisory:...

doopass (>=2.7.0, <=2.9.0), dran2 (>=0.0.5, <=0.0.6) +6 more potentially affected by CVE-2026-102937 via virtualenv (20.26.2)

virtualenv PYPI version 20.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - doopass =2.7.0, =0.0.5, =1.0.1, =1.0.0, =0.1.4, =0.1.0, =0.2.0 - openpy-ts-clu 0.1.0 Source cves: CVE-2026-102937 Source advisory:...

hatch (1.9.7) potentially affected by CVE-2026-102937 via virtualenv (20.25.3)

virtualenv PYPI version 20.25.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch 1.9.7 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...