Hi,
The following vulnerabilities were published for python-virtualenv.
CVE-2026-102925[0]:
| virtualenv is a tool for creating isolated virtual python
| environments. Prior to 21.7.13, the generated activate (bash and
| zsh) and activate.fish scripts place values already escaped by
| shlex.quote inside an additional quoted context. In the bash and zsh
| script, a crafted virtual environment path reaches __VIRTUAL_ENV__
| when a relocated environment's recorded directory is absent; in the
| fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__
| or __TK_LIBRARY__. The surplus quotes can terminate the data-only
| quoted run and leave shell metacharacters parsed as commands when a
| user sources the activation script, allowing code execution with
| that user's privileges. This issue is fixed in version 21.7.13.
CVE-2026-102930[1]:
| virtualenv is a tool for creating isolated virtual python
| environments. Prior to 21.7.12, download_wheel() accepts pip and
| setuptools seed wheels fetched for periodic updates or the
| --download option without checking their bytes against an
| authoritative digest equivalent to the embedded wheels'
| BUNDLE_SHA256 verification. A compromised index, stale mirror, or
| intercepted TLS connection can substitute a different wheel under
| the requested distribution, version, and filename, after which
| virtualenv caches and seeds the attacker-controlled wheel into
| subsequently created environments. The verification applies to the
| default PyPI path and is intentionally skipped when PIP_INDEX_URL,
| PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may
| legitimately publish rebuilt wheels. This issue is fixed in version
| 21.7.12.
CVE-2026-102938[2]:
| virtualenv is a tool for creating isolated virtual python
| environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt
| values verbatim to the line-oriented pyvenv.cfg format while
| PyEnvCfg._read_values() parses the file with str.splitlines() and
| accepts the last value for duplicate keys. An attacker who
| influences --prompt, VIRTUALENV_PROMPT, or configuration input can
| insert a recognized line boundary and additional keys, including
| home, causing consumers to use an attacker-selected base interpreter
| or corrupted environment metadata. The security impact requires
| prompt input from outside the operator's trust boundary; directly
| supplied prompt content primarily corrupts the operator's own
| environment. This issue is fixed in version 21.7.11.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-102925
https://www.cve.org/CVERecord?id=CVE-2026-102925
[1] https://security-tracker.debian.org/tracker/CVE-2026-102930
https://www.cve.org/CVERecord?id=CVE-2026-102930
[2] https://security-tracker.debian.org/tracker/CVE-2026-102938
https://www.cve.org/CVERecord?id=CVE-2026-102938
Regards,
Salvatore