pattooshared (>=0.0.95, <=0.0.120) potentially affected by CVE-2026-102930 via virtualenv (20.0.30)

virtualenv PYPI version 20.0.30 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pattooshared =0.0.95, =0.0.120 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

PT-2026-102925

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.12 Description The BatchActivator.quote function fails to properly sanitize prompt text before it is inserted into a cmd.exe set statement within the activate.bat file. An attacker capable of influencing the...

PT-2026-105772

download wheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLE SHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or th...

PT-2026-105775

BatchActivator.quote returned its input unchanged, the only activator with no escaping at all. --prompt, the VIRTUALENV PROMPT environment variable, and the config file all set the prompt, and activate.bat writes it straight into @set "VAR=value". A prompt containing a double quote closes that...

EulerOS Virtualization 2.11.1 : python-virtualenv (EulerOS-SA-2026-3469)

According to the versions of the python-virtualenv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...

EulerOS Virtualization 2.11.0 : python-virtualenv (EulerOS-SA-2026-3556)

According to the versions of the python-virtualenv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...

PT-2026-102923

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.13 Description The generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In bash and zsh scripts, a crafted virtual...

PT-2026-102924

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.12 Description The download wheel function fails to verify the bytes of pip and setuptools seed wheels fetched during periodic updates or via the --download option against an authoritative digest, unlike the...

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.writewrote values verbatim, while PyEnvCfg.readvalues parses the file withstr.splitlines. A value containing a line boundary therefore becameadditional configuration lines, and because reading is last-wins, the injectedkeys replace...

PYSEC-2026-4012 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write wrote values verbatim, while PyEnvCfg.readvalues parses the file with str.splitlines. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys...

pip-faster (>=1.0.0rc1, <=1.0.0rc6.dev4) potentially affected by CVE-2026-102938 via virtualenv (1.11.6)

virtualenv PYPI version 1.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pip-faster =1.0.0rc1, =1.0.0rc6.dev4 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

dcoscli (>=0.1.1, <=0.1.8) potentially affected by CVE-2026-102938 via virtualenv (12.1.1)

virtualenv PYPI version 12.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.1, =0.1.8 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

uranium (>=0.2.8, <=0.2.22) potentially affected by CVE-2026-102938 via virtualenv (13.1.0)

virtualenv PYPI version 13.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - uranium =0.2.8, =0.2.22 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

dcoscli (>=0.1.9, <=0.4.6), python-mu (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-102938 via virtualenv (13.1.2)

virtualenv PYPI version 13.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.9, =1.0.1, =0.2.23, =0.2.34 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

cloudmesh-client (4.2.6) potentially affected by CVE-2026-102938 via virtualenv (15.0.1)

virtualenv PYPI version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cloudmesh-client 4.2.6 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

debpackager (>=0.1.0, <=0.2.1), scriptworker (0.2.1) +1 more potentially affected by CVE-2026-102938 via virtualenv (15.0.2)

virtualenv PYPI version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - debpackager =0.1.0, =0.2.35, =1.1.0 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-102938 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-102938 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

pystarter (>=1.0.0, <=1.1.2), terraenv (>=0.6.0.dev0, <=0.6.2) potentially affected by CVE-2026-102938 via virtualenv (16.1.0)

virtualenv PYPI version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pystarter =1.0.0, =0.6.0.dev0, =0.6.2 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

fzpycreate (>=0.0.12, <=2.0.0), neo-python (0.8.4) potentially affected by CVE-2026-102938 via virtualenv (16.2.0)

virtualenv PYPI version 16.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - fzpycreate =0.0.12, =2.0.0 - neo-python 0.8.4 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...