Pypa Virtualenv vulnerabilities

• pypa virtualenv virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) CVE-2026-115586 Fix available 7.1 HighOctober 23, 2026
• pypa virtualenv virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST CVE-2026-113726 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv activation scripts run code from a path that contains a placeholder name CVE-2026-113776 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote CVE-2026-113732 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv bash activate runs commands from an environment name with a backslash before $ CVE-2026-113725 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv: Deletion recovery can change a symlink target's mode CVE-2026-113724 Fix available 4.5 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Bash prompt values can change meaning under older compatibility modes CVE-2026-113723 Fix available 7.1 HighOctober 20, 2026
• pypa virtualenv virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax CVE-2026-113722 Fix available 7.8 HighOctober 20, 2026
• pypa virtualenv virtualenv: Generated files can follow existing destination links CVE-2026-113721 Fix available 4.5 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Seeded files retain permissions from an older cache CVE-2026-113720 Fix available 4.4 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Venv configuration readback can reinterpret path boundaries CVE-2026-113715 Fix available 2.0 LowOctober 20, 2026
• pypa virtualenv virtualenv: Seed replacement does not contain metadata deletion paths CVE-2026-113719 Fix available 4.5 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Xonsh activation literals depend on the script decoding codec CVE-2026-113718 Fix available 7.1 HighOctober 20, 2026
• pypa virtualenv virtualenv: Pip seeding with download omits wheel digest verification CVE-2026-113717 Fix available 2.3 LowOctober 20, 2026
• pypa virtualenv virtualenv: Builtin creation follows linked environment directories CVE-2026-113716 Fix available 4.5 MediumOctober 20, 2026
• pypa virtualenv virtualenv: Downloaded wheel selection and caching precede verification CVE-2026-113714 Fix available 2.3 LowOctober 20, 2026
• pypa virtualenv virtualenv: Temporary app-data can leave dangling seed package links CVE-2026-113713 Fix available 4.4 MediumOctober 20, 2026
• pypa virtualenv virtualenv bash and fish activation scripts execute commands embedded in paths CVE-2026-102925 Fix available 7.8 HighSeptember 18, 2026
• pypa virtualenv virtualenv: Command injection via --prompt in activate.bat (batch activator) CVE-2026-102937 Fix available 7.3 HighSeptember 18, 2026
• pypa virtualenv virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use CVE-2026-102930 Fix available 7.7 HighSeptember 18, 2026
• pypa virtualenv virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection CVE-2026-102938 Fix available 5.8 MediumSeptember 17, 2026
• pypa virtualenv virtualenv Has TOCTOU Vulnerabilities in Directory Creation CVE-2026-22702 Fix available 4.5 MediumJanuary 10, 2026