cosmic-ray (>=6.1.1, <=8.3.5), fauxpy (>=0.1.0, <=0.7.0) +1 more potentially affected by CVE-2026-113715 via virtualenv (16.7.10)

virtualenv PYPI version 16.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cosmic-ray =6.1.1, =0.1.0, =0.7.0 - pickley 2.0.14 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...

GHSA-QMX5-4P3X-WVQF virtualenv: Venv configuration readback can reinterpret path boundaries

Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-113715 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...

pokpok-sdk (>=0.1.3, <=0.1.6) potentially affected by CVE-2026-113715 via virtualenv (20.29.1)

virtualenv PYPI version 20.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pokpok-sdk =0.1.3, =0.1.6 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...

buildpan (>=0.0.12, <=0.0.22), buildpan-cli (1.0.0) +6 more potentially affected by CVE-2026-113719 via virtualenv (20.6.0)

virtualenv PYPI version 20.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - buildpan =0.0.12, =0.1.0, =0.0.0, =0.0.1, =0.0.1, =3.0.2, =3.0.4 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

awsegy (0.1.4), azure-devops-artifacts-helpers (>=0.0.1, <=1.0.6) +1 more potentially affected by CVE-2026-113719 via virtualenv (20.1.0)

virtualenv PYPI version 20.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - awsegy 0.1.4 - azure-devops-artifacts-helpers =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

delete-branches (1.2.15), delete-workflow-runs (1.2.33) +12 more potentially affected by CVE-2026-113719 via virtualenv (20.35.4)

virtualenv PYPI version 20.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.15 - delete-workflow-runs 1.2.33 - elroy =0.0.62, =0.0.1b1, =0.6.0, =2.2.1, =6.0.0, =1.2.3, =0.6.2, =0.7.0 Source cves...

b1ddi (0.0.2), delete-branches (>=1.0.0, <=1.1.3) +15 more potentially affected by CVE-2026-113719 via virtualenv (20.34.0)

virtualenv PYPI version 20.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - b1ddi 0.0.2 - delete-branches =1.0.0, =1.1.14, =1.0.0, =1.1.0, =1.17.0, =1.25.0 and more Source cves: CVE-2026-113719 Source advisory:...

hatch (1.9.7) potentially affected by CVE-2026-113719 via virtualenv (20.25.3)

virtualenv PYPI version 20.25.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch 1.9.7 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

pystarter (>=1.0.0, <=1.1.2), terraenv (>=0.6.0.dev0, <=0.6.2) potentially affected by CVE-2026-113719 via virtualenv (16.1.0)

virtualenv PYPI version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pystarter =1.0.0, =0.6.0.dev0, =0.6.2 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

rooster-client (0.0.1) potentially affected by CVE-2026-113719 via virtualenv (20.17.0)

virtualenv PYPI version 20.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - rooster-client 0.0.1 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

hatch (>=1.0.0rc2, <=1.0.0rc8) potentially affected by CVE-2026-113719 via virtualenv (20.11.2)

virtualenv PYPI version 20.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch =1.0.0rc2, =1.0.0rc8 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

chicken-coop (>=0.0.1, <=0.0.5), im-openai (0.8.2) potentially affected by CVE-2026-113719 via virtualenv (20.24.2)

virtualenv PYPI version 20.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chicken-coop =0.0.1, =0.0.5 - im-openai 0.8.2 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

create-fastapi (>=0.0.1, <=0.0.11), questionbankgenerator (1.0.0) potentially affected by CVE-2026-113719 via virtualenv (20.24.7)

virtualenv PYPI version 20.24.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - create-fastapi =0.0.1, =0.0.11 - questionbankgenerator 1.0.0 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

pytoil (0.36.0), team13hackertype (>=1.0.1, <=1.0.4) potentially affected by CVE-2026-113719 via virtualenv (20.16.6)

virtualenv PYPI version 20.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pytoil 0.36.0 - team13hackertype =1.0.1, =1.0.4 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

EUVD-2026-105300

virtualenv: Seed replacement does not contain metadata deletion paths...

GHSA-HHXQ-47XX-J5XX virtualenv: Seed replacement does not contain metadata deletion paths

Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026...

cloudmesh-client (4.2.6) potentially affected by CVE-2026-113719 via virtualenv (15.0.1)

virtualenv PYPI version 15.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cloudmesh-client 4.2.6 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

c2cciutils (>=1.1.16, <=1.1.46), crl-devutils (>=1.3.1, <=1.4.0) potentially affected by CVE-2026-113719 via virtualenv (20.13.4)

virtualenv PYPI version 20.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - c2cciutils =1.1.16, =1.3.1, =1.4.0 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

sym-sdk (>=0.0.1, <=0.0.22) potentially affected by CVE-2026-113719 via virtualenv (20.4.1)

virtualenv PYPI version 20.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - sym-sdk =0.0.1, =0.0.22 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...