delete-branches (1.2.14), delete-workflow-runs (1.2.32) +6 more potentially affected by CVE-2026-102925 via virtualenv (20.35.3)

virtualenv PYPI version 20.35.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.14 - delete-workflow-runs 1.2.32 - ironoc-pytest-conor-heffron =2.1.7, =2.2.0 - pkg-15903 0.1.100 - pkg-26548 1.3.32 -...

pad-final-project (>=0.1.3, <=0.1.7), ppmanager (>=0.1.2, <=0.4.0) potentially affected by CVE-2026-102925 via virtualenv (20.28.0)

virtualenv PYPI version 20.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pad-final-project =0.1.3, =0.1.2, =0.4.0 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

allora-sdk (>=0.1.0, <=0.2.3), coinbase-agentkit (>=0.1.7.dev202503141, <=0.6.0) +2 more potentially affected by CVE-2026-102925 via virtualenv (20.28.1)

virtualenv PYPI version 20.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - allora-sdk =0.1.0, =0.1.7.dev202503141, =0.1.1.dev202503260, =0.1.1.dev202503260, =0.3.0 Source cves: CVE-2026-102925 Source advisory:...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-102925 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-102925 Source advisory:...

waldiez-runner (0.5.9) potentially affected by CVE-2026-102925 via virtualenv (20.33.0)

virtualenv PYPI version 20.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - waldiez-runner 0.5.9 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

delete-branches (1.2.15), delete-workflow-runs (1.2.33) +12 more potentially affected by CVE-2026-102925 via virtualenv (20.35.4)

virtualenv PYPI version 20.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.15 - delete-workflow-runs 1.2.33 - elroy =0.0.62, =0.0.1b1, =0.6.0, =2.2.1, =6.0.0, =1.2.3, =0.6.2, =0.7.0 Source cves...

PYSEC-2026-4013 virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when...

dcoscli (>=0.1.9, <=0.4.6), python-mu (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-102925 via virtualenv (13.1.2)

virtualenv PYPI version 13.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.9, =1.0.1, =0.2.23, =0.2.34 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

bitdust-p2p (>=0.0.2, <=0.0.3), dweather-client (>=1.1.0, <=1.3.0) +1 more potentially affected by CVE-2026-102925 via virtualenv (20.0.21)

virtualenv PYPI version 20.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bitdust-p2p =0.0.2, =1.1.0, =0.2.3, =0.2.5 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

bento-cli (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-102925 via virtualenv (16.7.5)

virtualenv PYPI version 16.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bento-cli =0.1.0, =0.1.1 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

cabrita (>=2.2.2b1, <=2.2.2b2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-102925 via virtualenv (16.0.0)

virtualenv PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cabrita =2.2.2b1, =0.7.8, =0.7.2, =1.7.2, =1.11.0 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

hmd-cli-repo (>=0.2.81, <=0.3.141), neuronsphere (>=1.0.2, <=1.0.50) +1 more potentially affected by CVE-2026-102925 via virtualenv (20.13.2)

virtualenv PYPI version 20.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hmd-cli-repo =0.2.81, =1.0.2, =1.0.50 - pytoil 0.27.0 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate ashlex.quote-ed value into a position that quotes it a second time. The extraquotes terminate the quoted run early and leave part of the value parsed asshell code, so a path containing shell metacharacters runs commands when a...

hatch (>=1.0.0rc2, <=1.0.0rc8) potentially affected by CVE-2026-102937 via virtualenv (20.11.2)

virtualenv PYPI version 20.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch =1.0.0rc2, =1.0.0rc8 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...

aiap-model (0.0.0), getsome (0.1.1) +6 more potentially affected by CVE-2026-102930 via virtualenv (20.13.0)

virtualenv PYPI version 20.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aiap-model 0.0.0 - getsome 0.1.1 - invenio-cli =1.0.4, =0.0.1, =0.0.1, =0.17.0, =1.0.1.dev3, =0.0.1, =0.0.3 Source cves: CVE-2026-102930...

aiap-model (0.0.0), getsome (0.1.1) +6 more potentially affected by CVE-2026-102937 via virtualenv (20.13.0)

virtualenv PYPI version 20.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aiap-model 0.0.0 - getsome 0.1.1 - invenio-cli =1.0.4, =0.0.1, =0.0.1, =0.17.0, =1.0.1.dev3, =0.0.1, =0.0.3 Source cves: CVE-2026-102937...

limbo (8.6.1), python-thingiverse (>=0.0.6rc1.dev0, <=0.0.7.dev0) +1 more potentially affected by CVE-2026-102937 via virtualenv (20.13.1)

virtualenv PYPI version 20.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - limbo 8.6.1 - python-thingiverse =0.0.6rc1.dev0, =0.26.0, =0.26.1 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...

hmd-cli-repo (>=0.2.81, <=0.3.141), neuronsphere (>=1.0.2, <=1.0.50) +1 more potentially affected by CVE-2026-102930 via virtualenv (20.13.2)

virtualenv PYPI version 20.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hmd-cli-repo =0.2.81, =1.0.2, =1.0.50 - pytoil 0.27.0 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

pickley (>=3.1.1, <=3.1.5), pytoil (0.28.0) potentially affected by CVE-2026-102937 via virtualenv (20.13.3)

virtualenv PYPI version 20.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pickley =3.1.1, =3.1.5 - pytoil 0.28.0 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...

ezflow (>=0.2.1, <=0.2.4) potentially affected by CVE-2026-102930 via virtualenv (20.5.0)

virtualenv PYPI version 20.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ezflow =0.2.1, =0.2.4 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...