lftools (0.31.2) potentially affected by CVE-2026-102925 via virtualenv (20.0.9)

virtualenv PYPI version 20.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - lftools 0.31.2 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102925 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102925 Source advisory:...

cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-102925 via virtualenv (16.7.10)

virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

pickley (1.9.19), thaispoon (0.0.1) potentially affected by CVE-2026-102925 via virtualenv (16.7.7)

virtualenv PYPI version 16.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pickley 1.9.19 - thaispoon 0.0.1 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2026-102925 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

python-webex-bot (0.51.0) potentially affected by CVE-2026-102925 via virtualenv (16.4.3)

virtualenv PYPI version 16.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - python-webex-bot 0.51.0 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

cabrita (>=2.2.2b1, <=2.2.2b2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-102925 via virtualenv (16.0.0)

virtualenv PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cabrita =2.2.2b1, =0.7.8, =0.7.2, =1.7.2, =1.11.0 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-102925 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

debpackager (>=0.1.0, <=0.2.1), scriptworker (0.2.1) +1 more potentially affected by CVE-2026-102925 via virtualenv (15.0.2)

virtualenv PYPI version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - debpackager =0.1.0, =0.2.35, =1.1.0 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

PYSEC-2026-4013 virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when...

virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate ashlex.quote-ed value into a position that quotes it a second time. The extraquotes terminate the quoted run early and leave part of the value parsed asshell code, so a path containing shell metacharacters runs commands when a...

dreamai (>=0.10.0, <=0.12.0), nb-cli (>=1.0.0, <=1.2.4) +5 more potentially affected by CVE-2026-102925 via virtualenv (20.17.1)

virtualenv PYPI version 20.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dreamai =0.10.0, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.0.4 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

ducktape (0.7.16), gym-simplifiedtetris-avela (0.1.6) +3 more potentially affected by CVE-2026-102930 via virtualenv (20.16.2)

virtualenv PYPI version 20.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ducktape 0.7.16 - gym-simplifiedtetris-avela 0.1.6 - pgsync =2.4.0, =1.66.5, =2.3.3 Source cves: CVE-2026-102930 Source advisory:...

ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-102930 via virtualenv (20.15.1)

virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

azure-devops-artifacts-helpers (1.0.10), deepof (>=0.1.8, <=0.1.85) +7 more potentially affected by CVE-2026-102930 via virtualenv (20.14.1)

virtualenv PYPI version 20.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers 1.0.10 - deepof =0.1.8, =0.1.5, =0.30.0, =0.0.3, =1.0.1, =0.0.4, =0.3.0, =0.4.6 Source cves: CVE-2026-10293...

alice-ci (>=0.0.2, <=0.0.9), pickley (3.1.6) +1 more potentially affected by CVE-2026-102930 via virtualenv (20.14.0)

virtualenv PYPI version 20.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - alice-ci =0.0.2, =0.0.9 - pickley 3.1.6 - pytoil 0.29.0 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

c2cciutils (>=1.1.16, <=1.1.46), crl-devutils (>=1.3.1, <=1.4.0) potentially affected by CVE-2026-102930 via virtualenv (20.13.4)

virtualenv PYPI version 20.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - c2cciutils =1.1.16, =1.3.1, =1.4.0 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

pickley (>=3.1.1, <=3.1.5), pytoil (0.28.0) potentially affected by CVE-2026-102930 via virtualenv (20.13.3)

virtualenv PYPI version 20.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pickley =3.1.1, =3.1.5 - pytoil 0.28.0 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

hmd-cli-repo (>=0.2.81, <=0.3.141), neuronsphere (>=1.0.2, <=1.0.50) +1 more potentially affected by CVE-2026-102930 via virtualenv (20.13.2)

virtualenv PYPI version 20.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hmd-cli-repo =0.2.81, =1.0.2, =1.0.50 - pytoil 0.27.0 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

limbo (8.6.1), python-thingiverse (>=0.0.6rc1.dev0, <=0.0.7.dev0) +1 more potentially affected by CVE-2026-102930 via virtualenv (20.13.1)

virtualenv PYPI version 20.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - limbo 8.6.1 - python-thingiverse =0.0.6rc1.dev0, =0.26.0, =0.26.1 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...