virtualenv

CVE-2026-113719: CVE-2026-113719: Arbitrary File Deletion via Path Traversal in virtualenv Seed Package Metadata CVE-2026-113719: Arbitrary File Deletion via Path Traversal in virtualenv Seed Package Metadata > Vulnerability ID: CVE-2026-113719 > CVSS Score: 4.5 > Published: 2026-10-23 A path traversal vulnerability in PyPA virtualenv prior to version 21.14.9 allows local attackers to cause arbitrary file and directory deletion when a virtual environment target directory containing untrusted distribution metadata is reused or reseeded. TL;DR virtualenv < 21.14.9 fails to validate path boundaries when parsing seed metadata during environment re-creation, allowing local malicious metadata to trigger arbitrary file deletion. --- ⚠️ Exploit Status: POC Technical Details - Vulnerability ID: CVE-2026-113719 - CWE ID: CWE-22 - CVSS v3.1 Score: 4.5 (Medium) - CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - EPSS Score: 0.00117 (1.57th percentile) - Impact: Arbitrary File Deletion - Exploit Status: Proof of Concept / Local Pre-condition - CISA KEV Status: Not Listed Affected Systems - virtualenv versions < 21.14.9 on Python environments (Linux, macOS, Windows) - virtualenv: < 21.14.9 (Fixed in: 21.14.9) Code Analysis Commit: e3cea6f Limit seed-package cleanup to entries inside the environment. Limit seed-package cleanup to entries inside the environment. Ignore metadata entries that name the environment itself or resolve outside with a warning. Exploit Details - GitHub Security Advisory: Advisory details path traversal vulnerability during seed cleanup. Mitigation Strategies - Upgrade virtualenv package to version 21.14.9 or later. - Enforce explicit --clear flag during automated virtual environment re-creation workflows. - Restrict directory write permissions on target environments in shared system paths. Remediation Steps: 1. Run 'pip install --upgrade virtualenv' to update to version >= 21.14.9. 2. Audit automated build scripts and CI/CD pipelines to ensure virtual environment reuse uses the --clear flag. 3. Verify system directory permissions on shared build locations to prevent local untrusted metadata injection. References - GitHub Security Advisory GHSA-hhxq-47xx-j5xx - Fix Commit in pypa/virtualenv - Pull Request #3428: Limit seed-package cleanup to entries inside the environment - virtualenv Release Tag 21.14.9 - NVD CVE-2026-113719 Detail - CVE.org Record for CVE-2026-113719 --- Read the full report for CVE-2026-113719 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-113715: CVE-2026-113715: Configuration Key Injection via Unicode Line Boundary in virtualenv CVE-2026-113715: Configuration Key Injection via Unicode Line Boundary in virtualenv > Vulnerability ID: CVE-2026-113715 > CVSS Score: 2.0 > Published: 2026-10-23 In virtualenv versions prior to 21.14.9, creating isolated Python virtual environments using the standard library creator (--creator venv) allows configuration key injection into pyvenv.cfg if an attacker can control or influence the destination directory path containing Unicode line break characters. TL;DR virtualenv prior to 21.14.9 fails to sanitize Unicode line break characters in destination directory paths, allowing configuration parameter injection into pyvenv.cfg when using the stdlib venv creator. --- Technical Details - Vulnerability ID: CVE-2026-113715 / GHSA-qmx5-4p3x-wvqf - CWE ID: CWE-93 (Improper Neutralization of CRLF Sequences) - CVSS v4.0 Score: 2.0 (Low) - CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Affected Component: virtualenv (--creator venv) - Exploit Maturity: None (No public exploit) - Patched Version: 21.14.9 Affected Systems - virtualenv (PyPI package prior to 21.14.9) - virtualenv: < 21.14.9 (Fixed in: 21.14.9) Code Analysis Commit: b0008a5 Fix pyvenv.cfg CRLF / line boundary injection via venv creator path Mitigation Strategies - Upgrade virtualenv to version 21.14.9 or higher. - Validate and sanitize untrusted target directory paths prior to environment creation. - Ensure virtualenv execution does not take unescaped file path inputs directly from unauthenticated users. Remediation Steps: 1. Run pip install --upgrade 'virtualenv>=21.14.9' in your build environments. 2. Audit automated deployment scripts calling virtualenv --creator venv with user-supplied paths. 3. Verify system installations using virtualenv --version. References - GitHub Security Advisory GHSA-qmx5-4p3x-wvqf - Fix Commit b0008a58885ded9227faf8f910c6c402712c750a - Pull Request #3426 - virtualenv Release 21.14.9 - NVD Detail CVE-2026-113715 - CVE.org CVE-2026-113715 Record --- Read the full report for CVE-2026-113715 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-113723: CVE-2026-113723: OS Command Injection via Unsafe Prompt Expansion in PyPA virtualenv CVE-2026-113723: OS Command Injection via Unsafe Prompt Expansion in PyPA virtualenv > Vulnerability ID: CVE-2026-113723 > CVSS Score: 7.1 > Published: 2026-10-23 A command injection vulnerability in PyPA virtualenv prior to version 21.14.9 allows local attackers to execute arbitrary commands when a user sources a generated shell activation script containing a crafted prompt value. TL;DR Unsafe string replacement in virtualenv bash activation scripts allows arbitrary command execution via crafted prompt names during environment activation. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-78 - CVSS v4.0 Score: 7.1 (High) - Attack Vector: Local - EPSS Score: 0.00142 (3.23th percentile) - CISA KEV: Not Listed - Exploit Status: Proof of Concept Available - Impact: Arbitrary Code Execution Affected Systems - PyPA virtualenv prior to version 21.14.9 - Linux, macOS, and Unix systems sourcing Bash/Zsh activation scripts - virtualenv: < 21.14.9 (Fixed in: 21.14.9) Code Analysis Commit: 5f48d71 Fix PS1 prompt escaping and evaluation logic in bash activation script Exploit Details - GitHub Security Advisory: Advisory detailing proof-of-concept command injection via crafted prompt strings. Mitigation Strategies - Upgrade virtualenv to version 21.14.9 or higher. - Regenerate pre-existing virtual environments created with vulnerable virtualenv releases. - Set VIRTUAL_ENV_DISABLE_PROMPT=1 in shell environments to skip PS1 modifications. Remediation Steps: 1. Execute 'pip install --upgrade virtualenv>=21.14.9' in the environment build pipeline. 2. Remove old virtual environment directories using 'rm -rf .venv'. 3. Re-create virtual environments using the updated virtualenv package. 4. Verify that bin/activate contains literal variable references for PS1 assignments. References - GitHub Security Advisory GHSA-6w3r-xr62-4xcp - Fix Commit 5f48d711731311428aebfae61d46957762155b22 - GitHub Pull Request #3418 - virtualenv Release 21.14.9 - NIST NVD CVE-2026-113723 Record - CVE Program Record --- Read the full report for CVE-2026-113723 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-113720: CVE-2026-113720: Local Permission Inheritance Vulnerability in virtualenv CVE-2026-113720: Local Permission Inheritance Vulnerability in virtualenv > Vulnerability ID: CVE-2026-113720 > CVSS Score: 4.4 > Published: 2026-10-23 virtualenv prior to version 21.14.9 contains a local permission inheritance vulnerability in its app-data copy seeder. Due to the reliance on Python's standard shutil.copy() function, permissions from cached packages are replicated directly onto newly created virtual environment files, ignoring the active process umask and allowing unprivileged local attackers to inject code. TL;DR virtualenv < 21.14.9 uses shutil.copy() when seeding environments from the app-data cache, preserving original file modes and bypassing process umask. If the cache was populated under a loose umask, resulting virtual environment files may remain world- or group-writable, allowing local privilege escalation via code injection. --- Technical Details - Vulnerability ID: CVE-2026-113720 - CWE ID: CWE-732 (Incorrect Permission Assignment for Critical Resource) - CVSS v4.0 Score: 4.4 (Medium) - CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N - Attack Vector: Local - Exploit Status: No public weaponized exploit available - CISA KEV Status: Not listed - Patched Version: 21.14.9 Affected Systems - virtualenv < 21.14.9 - virtualenv: < 21.14.9 (Fixed in: 21.14.9) Code Analysis Commit: 35f0b33 Fix copy seeding file permission replication by enforcing process umask and using explicit mode defaults in virtualenv util path sync. Mitigation Strategies - Upgrade virtualenv to version 21.14.9 or higher. - Audit existing virtual environments created in multi-user or shared directories for permissive file modes. - Avoid populating global app-data caches under permissive process umasks such as 000 or 002. Remediation Steps: 1. Run 'pip install --upgrade virtualenv' to ensure virtualenv >= 21.14.9 is installed. 2. Identify existing vulnerable environments using 'find /path/to/venv -type f -perm -0002'. 3. Apply restrictive permissions using 'chmod 644' on standard environment files and 'chmod 755' on environment binaries. References - GitHub Security Advisory GHSA-fc2g-4w5p-6whm - NIST NVD CVE-2026-113720 Detail - CVE.org CVE-2026-113720 Record - virtualenv Pull Request #3425 - virtualenv Commit 35f0b33562790176dd186d0a3c517af3acc7a0e1 - virtualenv Release 21.14.9 --- Read the full report for CVE-2026-113720 on our website for more details including interactive diagrams and full exploit analysis.

CVE-2026-113718: CVE-2026-113718: Code Injection in pypa/virtualenv XonshActivator via Multibyte Encoding Misalignment CVE-2026-113718: Code Injection in pypa/virtualenv XonshActivator via Multibyte Encoding Misalignment > Vulnerability ID: CVE-2026-113718 > CVSS Score: 7.1 > Published: 2026-10-23 A code injection vulnerability in pypa/virtualenv prior to version 21.14.9 allows arbitrary command execution in xonsh shells using legacy multibyte encodings when sourcing activate.xsh. TL;DR Legacy multibyte encodings swallow escaping backslashes in virtualenv xonsh activation scripts, leading to shell literal breakout and code injection. --- Technical Details - CWE ID: CWE-94 - Attack Vector: Local - CVSS v4.0 Score: 7.1 (High) - EPSS Score: 0.00142 (3.23 percentile) - Vulnerability Impact: Code Injection / Command Execution - Exploit Availability: No Public Exploit - CISA KEV Status: Not Listed Affected Systems - pypa/virtualenv < 21.14.9 - xonsh shell activation environments using legacy multibyte encodings ($XONSH_ENCODING) - virtualenv: < 21.14.9 (Fixed in: 21.14.9) Code Analysis Commit: e5fc2e6 Keep literals independent of the encoding xonsh uses to read the script Mitigation Strategies - Upgrade virtualenv to version 21.14.9 or higher. - Re-create existing virtual environments to update activate.xsh files on disk. - Ensure environment configurations use UTF-8 encodings for $XONSH_ENCODING where applicable. Remediation Steps: 1. Execute 'pip install --upgrade virtualenv' to install version 21.14.9 or later. 2. Regenerate activation scripts for existing virtual environments. 3. Audit activate.xsh files to confirm prompt literals contain pure ASCII escape representations. References - GHSA-394h-qwmc-48pf Advisory - Fix Commit e5fc2e6e189a877ff559af288919e3525d13e5e0 - Pull Request #3432 - Virtualenv Release Tag 21.14.9 - NVD Vulnerability Detail - CVE.org CVE Record --- Read the full report for CVE-2026-113718 on our website for more details including interactive diagrams and full exploit analysis.

AnthropicがOSS Scannerを立ち上げてる！ anthropics/oss-scanner virtualenvのリリースノートで知りました oss-scanner#472 ルートの.oss-scanner/にDockerfileやthreat_model\.mdを置くんですね virtualenv#3387