TI-2026-79974 CVE-2026-115586 · GHSA-cx6f-vjhg-g3cc
Command injection in virtualenv Bash activator via --prompt value
Priority LOW 33
virtualenv is a tool for creating isolated virtual python environments.
Vulnerabilities
37 records
TI-2026-78529 CVE-2026-113726 · GHSA-5vjq-rrrf-7h2q
Command execution in virtualenv activate script under zsh
Priority LOW 36
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78536 CVE-2026-113776 · GHSA-8rjx-v5ww-45pp
virtualenv activation scripts run code from a path that contains a placeholder name
Priority LOW 36
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78535 CVE-2026-113732 · GHSA-c947-3pg5-gm8q
Command injection in virtualenv fish activation script
Priority LOW 36
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78528 CVE-2026-113725 · GHSA-vxj4-q4g9-crj7
Command injection in virtualenv bash activate via environment name
Priority LOW 36
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78527 CVE-2026-113724 · GHSA-43mp-35q3-x3fq
Symlink following in virtualenv deletion recovery changes file modes
Priority MEDIUM 54
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78526 CVE-2026-113723 · GHSA-6w3r-xr62-4xcp
Command injection in virtualenv bash activation prompt
Priority HIGH 66
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78525 CVE-2026-113722 · GHSA-c978-59m8-c77v
Shell command injection in virtualenv generated POSIX launchers
Priority HIGH 69
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78524 CVE-2026-113721 · GHSA-558c-9hv2-4prj
Link following in virtualenv lets local users overwrite files
Priority LOW 20
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78523 CVE-2026-113720 · GHSA-fc2g-4w5p-6whm
Stale file permissions in virtualenv seeded environments
Priority LOW 19
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78520 CVE-2026-113715 · GHSA-qmx5-4p3x-wvqf
Line-boundary injection in virtualenv pyvenv.cfg readback
Priority MEDIUM 44
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78522 CVE-2026-113719 · GHSA-hhxq-47xx-j5xx
Path traversal in virtualenv seed replacement can delete files
Priority MEDIUM 54
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-78521 CVE-2026-113718 · GHSA-394h-qwmc-48pf
Code injection in virtualenv Xonsh activation script
Priority HIGH 66
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-77006 CVE-2026-113717 · GHSA-cx28-75q4-x26q
Missing digest verification in virtualenv pip seeding with download
Priority MEDIUM 45
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-77005 CVE-2026-113716 · GHSA-cw65-gx24-rc82
Link following in virtualenv builtin creator writes outside target
Priority LOW 20
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-77004 CVE-2026-113714 · GHSA-494p-63j8-28p3
Wheel cache written before verification in virtualenv
Priority MEDIUM 45
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-77003 CVE-2026-113713 · GHSA-4f8h-vr72-p32c
Temporary app-data leaves dangling links in virtualenv environments
Priority MEDIUM 54
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-65544 CVE-2026-102938 · GHSA-9h9j-4vrj-gf7g
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
Priority LOW 25
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-65543 CVE-2026-102937 · GHSA-x78j-v8h9-3j2q
virtualenv: Command injection via --prompt in activate.bat (batch activator)
Priority LOW 39
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-65542 CVE-2026-102930 · GHSA-94p9-xgh2-xp45
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
Priority LOW 35
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-65541 CVE-2026-102925 · GHSA-p58f-9548-mpm2
virtualenv bash and fish activation scripts execute commands embedded in paths
Priority LOW 35
virtualenv is a tool for creating isolated virtual python environments.
TI-2026-11308 CVE-2026-13346 · GHSA-qwm4-qh6w-59xr
pip absolute path traversal during download from malicious package indexes
Priority LOW 25
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
TI-2026-42704 CVE-2026-59890 · GHSA-h35f-9h28-mq5c
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
Priority MEDIUM 60
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages.
TI-2026-07594 CVE-2026-8643 · GHSA-wf93-45jw-7689
pip can extract console_scripts and gui_scripts outside installation directory
Priority LOW 19
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…
TI-2026-19377 CVE-2026-24049 · GHSA-8rrh-rw8j-w5fx
wheel Allows Arbitrary File Permission Modification via Path Traversal
Priority MEDIUM 64
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.