awsegy (0.1.4), azure-devops-artifacts-helpers (>=0.0.1, <=1.0.6) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.1.0)

virtualenv PYPI version 20.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - awsegy 0.1.4 - azure-devops-artifacts-helpers =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Summary pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write wrote values verbatim, while PyEnvCfg.readvalues parses the file with str.splitlines. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected...

uranium (>=0.2.8, <=0.2.22) potentially affected by CVE-2026-102938 via virtualenv (13.1.0)

virtualenv PYPI version 13.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - uranium =0.2.8, =0.2.22 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

aiap-model (0.0.0), getsome (0.1.1) +6 more potentially affected by CVE-2026-102938 via virtualenv (20.13.0)

virtualenv PYPI version 20.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aiap-model 0.0.0 - getsome 0.1.1 - invenio-cli =1.0.4, =0.0.1, =0.0.1, =0.17.0, =1.0.1.dev3, =0.0.1, =0.0.3 Source cves: CVE-2026-102938...

cashu (0.15.1), cfg-analysis-tool-py (0.1.0) +7 more potentially affected by CVE-2026-102938 via virtualenv (20.25.0)

virtualenv PYPI version 20.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cashu 0.15.1 - cfg-analysis-tool-py 0.1.0 - edx-repo-tools 0.8.3 - mamba-toolbox =1.2.5.22, =0.2.1, =2.0.2, =0.1.15, =0.0.7, =0.0.8 Source...

ezflow (>=0.2.1, <=0.2.4) potentially affected by CVE-2026-102938 via virtualenv (20.5.0)

virtualenv PYPI version 20.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ezflow =0.2.1, =0.2.4 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-102938 via virtualenv (16.7.10)

virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

geotify (>=0.1.0, <=0.2.0), plutomanager (0.2.0) potentially affected by CVE-2026-102938 via virtualenv (20.25.2)

virtualenv PYPI version 20.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - geotify =0.1.0, =0.2.0 - plutomanager 0.2.0 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

optimizo (>=1.2.0, <=1.3.0), pencil-pusher (1.6.1) potentially affected by CVE-2026-102938 via virtualenv (20.4.7)

virtualenv PYPI version 20.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - optimizo =1.2.0, =1.3.0 - pencil-pusher 1.6.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

alice-ci (>=0.0.2, <=0.0.9), pickley (3.1.6) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.14.0)

virtualenv PYPI version 20.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - alice-ci =0.0.2, =0.0.9 - pickley 3.1.6 - pytoil 0.29.0 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-102938 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-102938 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

dcoscli (>=0.1.9, <=0.4.6), python-mu (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-102938 via virtualenv (13.1.2)

virtualenv PYPI version 13.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.9, =1.0.1, =0.2.23, =0.2.34 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

calendruparser (0.1.0), edx-repo-tools (0.8.2) +3 more potentially affected by CVE-2026-102938 via virtualenv (20.23.1)

virtualenv PYPI version 20.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - calendruparser 0.1.0 - edx-repo-tools 0.8.2 - engr131-2024 =0.0.1, =0.0.19, =0.1.5, =0.2.0 Source cves: CVE-2026-102938 Source advisory:...

ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.15.1)

virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

dai-python-commons (>=5.4.17, <=5.4.18), foundation-cancer-image-biomarker (>=1.0.1a4, <=1.0.1a5) +6 more potentially affected by CVE-2026-102938 via virtualenv (20.27.1)

virtualenv PYPI version 20.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dai-python-commons =5.4.17, =1.0.1a4, =0.1.0, =0.1.1, =0.1.0, =0.1.3 - python-rektor-monitor 0.1.1 - pyxote 0.1.0 Source cves:...

hatch (>=1.0.0rc2, <=1.0.0rc8) potentially affected by CVE-2026-102938 via virtualenv (20.11.2)

virtualenv PYPI version 20.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch =1.0.0rc2, =1.0.0rc8 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

doopass (>=2.7.0, <=2.9.0), dran2 (>=0.0.5, <=0.0.6) +6 more potentially affected by CVE-2026-102938 via virtualenv (20.26.2)

virtualenv PYPI version 20.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - doopass =2.7.0, =0.0.5, =1.0.1, =1.0.0, =0.1.4, =0.1.0, =0.2.0 - openpy-ts-clu 0.1.0 Source cves: CVE-2026-102938 Source advisory:...

azure-devops-artifacts-helpers (1.0.10), deepof (>=0.1.8, <=0.1.85) +7 more potentially affected by CVE-2026-102938 via virtualenv (20.14.1)

virtualenv PYPI version 20.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers 1.0.10 - deepof =0.1.8, =0.1.5, =0.30.0, =0.0.3, =1.0.1, =0.0.4, =0.3.0, =0.4.6 Source cves: CVE-2026-10293...

dragg (0.0.0), dragg-gym (0.0.1) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.0.18)

virtualenv PYPI version 20.0.18 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dragg 0.0.0 - dragg-gym 0.0.1 - muses-lpdp =0.2.2, =0.4.0rc1590080566 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7...