UBUNTU-CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

CVE-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102938

The virtualenv tool, used for creating isolated Python environments, is vulnerable to configuration injection in versions prior to 21.7.11 . The root cause is that PyEnvCfg.write() writes prompt values verbatim to the pyvenv.cfg format, while PyEnvCfg._read_values() parses this file using str.spl...

5gasp-cli (>=0.1.0, <=0.4.0), ablator (0.0.1b3) +766 more potentially affected by CVE-2026-102938 via virtualenv (>=1.11.6, <=21.7.4)

virtualenv PYPI version =1.11.6, =0.1.0, =0.2.0, =0.1.0, =0.5.1, =1.0.9, =0.5.0, =2023.2.21, =2.0.1, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.3.4 and more Source cves: CVE-2026-102938 Source advisory: MEND:CVE-2026-102938...

CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102937

The virtualenv tool, used for creating isolated Python environments, is vulnerable to command injection on Windows in versions prior to 21.7.12 . The root cause is in BatchActivator.quote() , which fails to properly escape prompt text before activate.bat inserts it into a cmd.exe `set

CVE-2026-102937

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

CVE-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

5gasp-cli (>=0.1.0, <=0.4.0), ablator (0.0.1b3) +766 more potentially affected by CVE-2026-102937 via virtualenv (>=1.11.6, <=21.7.4)

virtualenv PYPI version =1.11.6, =0.1.0, =0.2.0, =0.1.0, =0.5.1, =1.0.9, =0.5.0, =2023.2.21, =2.0.1, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.3.4 and more Source cves: CVE-2026-102937 Source advisory: MEND:CVE-2026-102937...

CVE-2026-102937

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

CVE-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

CVE-2026-102937 virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

5gasp-cli (>=0.1.0, <=0.4.0), ablator (0.0.1b3) +766 more potentially affected by CVE-2026-102930 via virtualenv (>=1.11.6, <=21.7.4)

virtualenv PYPI version =1.11.6, =0.1.0, =0.2.0, =0.1.0, =0.5.1, =1.0.9, =0.5.0, =2023.2.21, =2.0.1, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.3.4 and more Source cves: CVE-2026-102930 Source advisory: MEND:CVE-2026-102930...

CVE-2026-102930 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

CVE-2026-102930

The virtualenv tool (prior to version 21.7.12 ) is vulnerable to a supply chain attack due to a lack of integrity verification in the download_wheel() function. When fetching pip and setuptools seed wheels for periodic updates or via the --download option, the software fails to verify the bytes a...

CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...