3031 matches found
SUSE CVE-2026-113717
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...
SUSE CVE-2026-113718
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...
SUSE CVE-2026-113719
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...
SUSE CVE-2026-113720
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...
SUSE CVE-2026-113721
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...
SUSE CVE-2026-113722
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer...
SUSE CVE-2026-113723
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...
CVE-2026-113722
virtualenv is a tool for creating isolated virtual python environments...
UBUNTU-CVE-2026-113715
virtualenv is a tool for creating isolated virtual python environments...
UBUNTU-CVE-2026-113716
virtualenv is a tool for creating isolated virtual python environments...
UBUNTU-CVE-2026-113717
virtualenv is a tool for creating isolated virtual python environments...
UBUNTU-CVE-2026-113726
virtualenv is a tool for creating isolated virtual python environments...
UBUNTU-CVE-2026-113722
virtualenv is a tool for creating isolated virtual python environments...
UBUNTU-CVE-2026-113725
virtualenv is a tool for creating isolated virtual python environments...
UBUNTU-CVE-2026-113732
virtualenv is a tool for creating isolated virtual python environments...
UBUNTU-CVE-2026-113720
virtualenv is a tool for creating isolated virtual python environments...
PT-2026-122207
Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.9 through 21.14.12 Description The bash bin/activate script fails to properly escape dollar signs and backticks when copying the --prompt value into the PS1 environment variable, provided that promptvars and POSIX mod...
PT-2026-122432
Summary The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt...