382 matches found
CVE-2026-102938: Improper Neutralization of CRLF Sequences
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...
CVE-2026-102925: Improper Neutralization of Special Elements used in an OS Command
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
CVE-2026-102937: Improper Neutralization of Special Elements used in an OS Command
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...
CVE-2026-102930: Download of Code Without Integrity Check
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...
ROOT-APP-PYPI-AIKIDO-2026-674766 AIKIDO-2026-674766 in virtualenv - Patched by Root
Root has patched AIKIDO-2026-674766 in the virtualenv package for Root:PyPI. Multiple fixed versions available...
PYSEC-2026-4013 virtualenv bash and fish activation scripts execute commands embedded in paths
The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when...
virtualenv bash and fish activation scripts execute commands embedded in paths
The generated activate bash/zsh and activate.fish scripts interpolate ashlex.quote-ed value into a position that quotes it a second time. The extraquotes terminate the quoted run early and leave part of the value parsed asshell code, so a path containing shell metacharacters runs commands when a...
Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
downloadwheel runs pip download and hands the result straight to theseeder, with nothing checking the bytes it gets back. The embedded pip andsetuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load,but a wheel fetched over the network for the periodic-update feature or...
PYSEC-2026-4011 Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
downloadwheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or the...
PT-2026-102923
Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.13 Description The generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In bash and zsh scripts, a crafted virtual...
EulerOS Virtualization 2.11.1 : python-virtualenv (EulerOS-SA-2026-3469)
According to the versions of the python-virtualenv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...
EulerOS Virtualization 2.11.0 : python-virtualenv (EulerOS-SA-2026-3556)
According to the versions of the python-virtualenv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...
PT-2026-102924
Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.12 Description The download wheel function fails to verify the bytes of pip and setuptools seed wheels fetched during periodic updates or via the --download option against an authoritative digest, unlike the...
PYSEC-2026-4012 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write wrote values verbatim, while PyEnvCfg.readvalues parses the file with str.splitlines. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys...
PT-2026-102926
Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.11 Description The PyEnvCfg.write function writes prompt values verbatim to the line-oriented pyvenv.cfg format, while PyEnvCfg. read values parses the file using str.splitlines and accepts the last value for...
CVE-2026-13346 affecting package python-virtualenv for versions less than 20.36.1-6
CVE-2026-13346 affecting package python-virtualenv for versions less than 20.36.1-6. A patched version of the package is available...
CVE-2026-13346 vulnerabilities
Vulnerabilities for packages: datadog-agent, kubeflow-katib, py3.14-virtualenv...
GHSA-QWM4-QH6W-59XR vulnerabilities
Vulnerabilities for packages: datadog-agent, kubeflow-katib, py3.14-virtualenv...
The vulnerability of the tool for creating isolated virtual environments in Python’s virtualenv, related to synchronization errors when using a shared resource, allows a malicious actor to trigger a service failure.
The vulnerability of the tool for creating isolated virtual environments in Python virtualenv is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...