CVE-2026-102925
published 2026-09-29CVE-2026-102925: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place…
PriorityP341high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.15%
4.0th percentile
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | ansible-dev-tools-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-devspaces-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-tech-preview | ansible-devspaces-rhel9 | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| debian | python-virtualenv | — | — |
| devspaces | udi-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| pypa | virtualenv | < 21.7.13 | 21.7.13 |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhel8 | python-36 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-kserve-agent-rhel9 | — | — |
| rhoai | odh-kserve-controller-rhel9 | — | — |
| rhoai | odh-kserve-router-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
virtualenv: virtualenv: Arbitrary code execution via crafted paths in activation scripts
vendor_redhat·2026-09-29·CVSS 7.8
CVE-2026-102925 [HIGH] CWE-94 virtualenv: virtualenv: Arbitrary code execution via crafted paths in activation scripts
virtualenv: virtualenv: Arbitrary code execution via crafted paths in activation scripts
A flaw was found in virtualenv. The generated activation scripts for shells such as bash, zsh, and fish apply improper quoting to environment and library path variables. An attacker can exploit this by providing a crafted virtual environment path containing shell metacharacters. When an unsuspecting user sources the activation script, the embedded metacharacters are executed as shell commands, leading to arbitrary code execution with the privileges of that user.
Package: openshift-lightspeed/lightspeed-service-api-rhel9 (OpenShift Lightspeed) - Affected
Package: ansible-automation-platform-25/ansible-dev-tools-rhel8 (Red Hat Ansible Automation Platform 2) - Affected
Package: ansible-automation-plat
GHSA
virtualenv bash and fish activation scripts execute commands embedded in paths
ghsa·2026-10-01
CVE-2026-102925 [HIGH] CWE-78 virtualenv bash and fish activation scripts execute commands embedded in paths
virtualenv bash and fish activation scripts execute commands embedded in paths
### Impact
The generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.
`activate` is affected through the virtual environment's own path, on the branch that reports a relocated environment:
```sh
echo "Virtual environment directory __VIRTUAL_ENV__ does not exist!" >&2
```
For a destination named `x'$(id)'y`, `shlex.quote` emits `'x'"'"'$(id)'"'"'y'`. The inner `"` closes the enclosing double quote and `$(id)` is left unquoted. B
VulDB
pypa virtualenv up to 21.7.12 Activation Scripts activate.fish os command injection
vuldb·2026-09-29·CVSS 7.8
CVE-2026-102925 [HIGH] pypa virtualenv up to 21.7.12 Activation Scripts activate.fish os command injection
A vulnerability was found in pypa virtualenv up to 21.7.12. It has been declared as problematic. This vulnerability affects unknown code of the file activate.fish of the component Activation Scripts. Such manipulation leads to os command injection.
This vulnerability is listed as CVE-2026-102925. The attack must be carried out locally. There is no available exploit.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
2026-09-29
Published