Pypa vulnerabilities
27 CVEs and advisories name Pypa as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115586virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
- CVE-2026-113726virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
- CVE-2026-113776virtualenv activation scripts run code from a path that contains a placeholder name
- CVE-2026-113732virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
- CVE-2026-113725virtualenv bash activate runs commands from an environment name with a backslash before $
- CVE-2026-113724virtualenv: Deletion recovery can change a symlink target's mode
- CVE-2026-113723virtualenv: Bash prompt values can change meaning under older compatibility modes
- CVE-2026-113722virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
- CVE-2026-113721virtualenv: Generated files can follow existing destination links
- CVE-2026-113720virtualenv: Seeded files retain permissions from an older cache
- CVE-2026-113715virtualenv: Venv configuration readback can reinterpret path boundaries
- CVE-2026-113719virtualenv: Seed replacement does not contain metadata deletion paths
- CVE-2026-113718virtualenv: Xonsh activation literals depend on the script decoding codec
- CVE-2026-113717virtualenv: Pip seeding with download omits wheel digest verification
- CVE-2026-113716virtualenv: Builtin creation follows linked environment directories
- CVE-2026-113714virtualenv: Downloaded wheel selection and caching precede verification
- CVE-2026-113713virtualenv: Temporary app-data can leave dangling seed package links
- CVE-2026-102938virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
- CVE-2026-102937virtualenv: Command injection via --prompt in activate.bat (batch activator)
- CVE-2026-102930virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
- CVE-2026-102925virtualenv bash and fish activation scripts execute commands embedded in paths
- CVE-2026-59890setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
- CVE-2026-24049wheel Allows Arbitrary File Permission Modification via Path Traversal
- CVE-2026-22702virtualenv Has TOCTOU Vulnerabilities in Directory Creation
- CVE-2025-47273setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
- CVE-2024-6345Remote Code Execution in pypa/setuptools
- CVE-2022-21668Pipenv's requirements.txt parsing allows malicious index url in comments