Virtualenv vulnerabilities

CVE-2013-5123 [MEDIUM] CWE-287 CVE-2013-5123: The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and au The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.

CVE-2024-53899 [HIGH] CWE-77 CVE-2024-53899: virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual envi virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

CVE-2026-113722 [HIGH] CWE-78 virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax ## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the sh

CVE-2026-113726 [HIGH] CWE-116 virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST ### Impact zsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so zsh gets the raw value. With the `PROMPT_SUBST`

CVE-2026-113776 [HIGH] CWE-78 virtualenv activation scripts run code from a path that contains a placeholder name virtualenv activation scripts run code from a path that contains a placeholder name ### Impact `ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted

CVE-2026-113732 [HIGH] CWE-116 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote ### Impact `FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\'` inside single quotes as an e

CVE-2026-102930 [HIGH] CWE-494 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use `download_wheel()` runs `pip download` and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a `BUNDLE_SHA256` that virtualenv checks on every load, but a wheel fetched over the network for the periodic-updat

CVE-2026-102925 [HIGH] CWE-78 virtualenv bash and fish activation scripts execute commands embedded in paths virtualenv bash and fish activation scripts execute commands embedded in paths ### Impact The generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs command

CVE-2026-113725 [HIGH] CWE-116 virtualenv bash activate runs commands from an environment name with a backslash before $ virtualenv bash activate runs commands from an environment name with a backslash before $ ### Summary The bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a backslash in the name undoes the escaping and a name containing `\$(...)` runs as commands in the user's shell each time bash draws the prompt. ### Affected ar

CVE-2026-102937 [HIGH] CWE-78 virtualenv: Command injection via --prompt in activate.bat (batch activator) virtualenv: Command injection via --prompt in activate.bat (batch activator) `BatchActivator.quote()` returned its input unchanged, the only activator with no escaping at all. `--prompt`, the `VIRTUALENV_PROMPT` environment variable, and the config file all set the prompt, and `activate.bat` writes it straight into `@set "VAR=value"`. A prompt containing a double quote closes that string e

CVE-2026-113718 [HIGH] CWE-94 virtualenv: Xonsh activation literals depend on the script decoding codec virtualenv: Xonsh activation literals depend on the script decoding codec ## Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. ## Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Pr

CVE-2026-115586 [HIGH] CWE-78 virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) ## Summary The bash activator puts the caller-supplied prompt value into `PS1` unescaped whenever `promptvars` is off at activation time, and assumes prompt

CVE-2026-102938 [MEDIUM] CWE-93 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection ### Summary `pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore b

CVE-2026-113723 [HIGH] CWE-78 virtualenv: Bash prompt values can change meaning under older compatibility modes virtualenv: Bash prompt values can change meaning under older compatibility modes ## Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. ## Affected area Bash runs with compatibility level 4.2 and draws the

CVE-2026-113716 [MEDIUM] CWE-59 virtualenv: Builtin creation follows linked environment directories virtualenv: Builtin creation follows linked environment directories ## Summary The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as `ANT-2026-MUFJEG11` in `virtualenv-20261015-005`, received on 15 October 2026. ## Affect

CVE-2026-113720 [MEDIUM] CWE-732 virtualenv: Seeded files retain permissions from an older cache virtualenv: Seeded files retain permissions from an older cache ## Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as `ANT-2026-487MH6OW` in `virtualenv-20261015-005`, recei

CVE-2026-22702 [MEDIUM] CWE-59 CVE-2026-22702: virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TO virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and cr

CVE-2026-113724 [MEDIUM] CWE-59 virtualenv: Deletion recovery can change a symlink target's mode virtualenv: Deletion recovery can change a symlink target's mode ## Summary The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as `ANT-2026-UK90QC27` in `virtualenv-20261015-005`, received on 15 October 2026.

CVE-2026-113713 [MEDIUM] CWE-377 virtualenv: Temporary app-data can leave dangling seed package links virtualenv: Temporary app-data can leave dangling seed package links ## Summary The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of `symlink_app_data` can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environ

CVE-2026-113719 [MEDIUM] CWE-22 virtualenv: Seed replacement does not contain metadata deletion paths virtualenv: Seed replacement does not contain metadata deletion paths ## Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as `ANT-2026-SXOEHWP7` in `virtualenv-20261015-005`, received on 15 October 2026. ## Affected area Remov