Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

virtualenv

24 known vulnerabilities (12 high, 8 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
21.15.6 (Nov 6, 2026): no advisory affects it
Newest unaffected release
21.15.6 (Nov 6, 2026), the latest release
Advisories
24 · 12 high, 8 medium, 3 low
Weekly downloads
59.5M
Dependents
3,718
Releases
316 since 0.8.0 (Sep 14, 2007)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 24 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 24

  • virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

    Affected: from 21.14.9, fixed in 21.14.13.

    Fixed in 21.14.13 (released Oct 22, 2026, 1 day before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

    Affected: fixed in 21.14.4.

    Fixed in 21.14.4 (released Oct 2, 2026, 18 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv activation scripts run code from a path that contains a placeholder name

    Affected: from 20.26.6, fixed in 21.14.2.

    Fixed in 21.14.2 (released Oct 1, 2026, 19 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

    Affected: fixed in 21.14.2.

    Fixed in 21.14.2 (released Oct 1, 2026, 19 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv bash activate runs commands from an environment name with a backslash before $

    Affected: fixed in 21.14.7.

    Fixed in 21.14.7 (released Oct 12, 2026, 8 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • CVE-2026-113724Medium 4.5

    virtualenv: Deletion recovery can change a symlink target's mode

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv: Bash prompt values can change meaning under older compatibility modes

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • CVE-2026-113721Medium 4.5

    virtualenv: Generated files can follow existing destination links

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • CVE-2026-113720Medium 4.4

    virtualenv: Seeded files retain permissions from an older cache

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv: Venv configuration readback can reinterpret path boundaries

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • CVE-2026-113719Medium 4.5

    virtualenv: Seed replacement does not contain metadata deletion paths

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv: Xonsh activation literals depend on the script decoding codec

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv: Pip seeding with download omits wheel digest verification

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • CVE-2026-113716Medium 4.5

    virtualenv: Builtin creation follows linked environment directories

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

Show all 24 advisoriesShow fewer advisories

  • virtualenv: Downloaded wheel selection and caching precede verification

    Affected: fixed in 21.14.9.

    Fixed in 21.14.9 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • CVE-2026-113713Medium 4.4

    virtualenv: Temporary app-data can leave dangling seed package links

    Affected: from 21.14.8, fixed in 21.14.10.

    Fixed in 21.14.10 (released Oct 17, 2026, 3 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • CVE-2026-102938Medium 5.8

    virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

    Affected: fixed in 21.7.11.

    Fixed in 21.7.11 (released Sep 17, 2026, 12 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv: Command injection via --prompt in activate.bat (batch activator)

    Affected: fixed in 21.7.12.

    Fixed in 21.7.12 (released Sep 18, 2026, 11 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

    Affected: fixed in 21.7.12.

    Fixed in 21.7.12 (released Sep 18, 2026, 11 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv bash and fish activation scripts execute commands embedded in paths

    Affected: fixed in 21.7.13.

    Fixed in 21.7.13 (released Sep 18, 2026, 11 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • CVE-2026-22702Medium 4.5

    virtualenv Has TOCTOU Vulnerabilities in Directory Creation

    Affected: fixed in 20.36.1.

    Fixed in 20.36.1 (released Jan 9, 2026, 1 day before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment.

    Affected: fixed in 20.26.6.

    Fixed in 20.26.6 (released Sep 27, 2024, 58 days before disclosure).

    The latest release, 21.15.6, is not affected.

  • virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

    Affected: fixed in 1.5.

    Fixed in 1.5.0 (released Sep 14, 2010, 473 days before disclosure).

    The latest release, 21.15.6, is not affected.