Action not permitted
Modal body text goes here.
Modal Title
Modal Body
Vulnerability from bitnami_vulndb
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches VIRTUAL_ENV when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach TCL_LIBRARY or TK_LIBRARY. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "virtualenv",
"purl": "pkg:bitnami/virtualenv"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.7.13"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
],
"aliases": [
"CVE-2026-102925"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*"
],
"severity": "High"
},
"details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment\u0027s recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user\u0027s privileges. This issue is fixed in version 21.7.13.",
"id": "BIT-virtualenv-2026-102925",
"modified": "2026-10-06T12:12:21.709Z",
"published": "2026-10-06T11:57:36.174Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3252"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102925"
}
],
"schema_version": "1.6.2",
"summary": "virtualenv bash and fish activation scripts execute commands embedded in paths"
}
BREW-CHARM-TOOLS-CVE-202… (PYSEC-2026-4013)
Vulnerability from osv_homebrew – Published: 2026-10-01 08:54 – Updated: 2026-10-06 17:33 – Source websiteImpact
The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.
activate is affected through the virtual environment's own path, on the branch that reports a relocated environment:
echo "Virtual environment directory __VIRTUAL_ENV__ does not exist!" >&2
For a destination named x'$(id)'y, shlex.quote emits 'x'"'"'$(id)'"'"'y'. The inner " closes the enclosing double quote and $(id) is left unquoted. Backtick and ; payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.
activate.fish is affected through the interpreter's Tcl/Tk library paths:
set -gx TCL_LIBRARY '__TCL_LIBRARY__'
shlex.quote already returns '/tcl/(cmd)/lib', so the rendered line is ''/tcl/(cmd)/lib''. fish concatenates the adjacent quoted runs and expands the (cmd) left between them. The same doubling also splits a path containing a space into two list elements, corrupting TCL_LIBRARY and TK_LIBRARY.
This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered activate.bat.
Patches
Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting shlex.quote applied. Fix: https://github.com/pypa/virtualenv/pull/3252
Workarounds
Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@20.39.1",
"upstream_fixed_in": "21.7.13"
},
"package": {
"ecosystem": "Homebrew",
"name": "charm-tools",
"purl": "pkg:brew/charm-tools"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.8_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@20.39.1",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "20.39.1"
}
]
},
"details": "### Impact\n\nThe generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.\n\n`activate` is affected through the virtual environment\u0027s own path, on the branch that reports a relocated environment:\n\n```sh\necho \"Virtual environment directory __VIRTUAL_ENV__ does not exist!\" \u003e\u00262\n```\n\nFor a destination named `x\u0027$(id)\u0027y`, `shlex.quote` emits `\u0027x\u0027\"\u0027\"\u0027$(id)\u0027\"\u0027\"\u0027y\u0027`. The inner `\"` closes the enclosing double quote and `$(id)` is left unquoted. Backtick and `;` payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.\n\n`activate.fish` is affected through the interpreter\u0027s Tcl/Tk library paths:\n\n```fish\nset -gx TCL_LIBRARY \u0027__TCL_LIBRARY__\u0027\n```\n\n`shlex.quote` already returns `\u0027/tcl/(cmd)/lib\u0027`, so the rendered line is `\u0027\u0027/tcl/(cmd)/lib\u0027\u0027`. fish concatenates the adjacent quoted runs and expands the `(cmd)` left between them. The same doubling also splits a path containing a space into two list elements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.\n\nThis is the same defect class as GHSA-x78j-v8h9-3j2q, which covered `activate.bat`.\n\n### Patches\n\nFixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting `shlex.quote` applied. Fix: https://github.com/pypa/virtualenv/pull/3252\n\n### Workarounds\n\nAvoid creating or distributing virtual environments whose path contains `\u0027`, `` ` ``, `$`, `;`, `(` or `)`, and inspect the generated activation script before sourcing one you did not create.",
"id": "BREW-charm-tools-CVE-2026-102925",
"modified": "2026-10-06T17:33:45Z",
"published": "2026-10-01T08:54:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102925"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3252"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4013.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "virtualenv bash and fish activation scripts execute commands embedded in paths",
"upstream": [
"PYSEC-2026-4013",
"CVE-2026-102925",
"GHSA-p58f-9548-mpm2",
"BIT-virtualenv-2026-102925"
]
}
BREW-CONDA-LOCK-CVE-2026… (GHSA-P58F-9548-MPM2)
Vulnerability from osv_homebrew – Published: 2026-10-04 15:51 – Updated: 2026-10-06 17:55 – Source websiteImpact
The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.
activate is affected through the virtual environment's own path, on the branch that reports a relocated environment:
echo "Virtual environment directory __VIRTUAL_ENV__ does not exist!" >&2
For a destination named x'$(id)'y, shlex.quote emits 'x'"'"'$(id)'"'"'y'. The inner " closes the enclosing double quote and $(id) is left unquoted. Backtick and ; payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.
activate.fish is affected through the interpreter's Tcl/Tk library paths:
set -gx TCL_LIBRARY '__TCL_LIBRARY__'
shlex.quote already returns '/tcl/(cmd)/lib', so the rendered line is ''/tcl/(cmd)/lib''. fish concatenates the adjacent quoted runs and expands the (cmd) left between them. The same doubling also splits a path containing a space into two list elements, corrupting TCL_LIBRARY and TK_LIBRARY.
This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered activate.bat.
Patches
Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting shlex.quote applied. Fix: https://github.com/pypa/virtualenv/pull/3252
Workarounds
Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@20.39.1",
"upstream_fixed_in": "21.7.13"
},
"package": {
"ecosystem": "Homebrew",
"name": "conda-lock",
"purl": "pkg:brew/conda-lock"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@20.39.1",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "20.39.1"
}
]
},
"details": "### Impact\n\nThe generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.\n\n`activate` is affected through the virtual environment\u0027s own path, on the branch that reports a relocated environment:\n\n```sh\necho \"Virtual environment directory __VIRTUAL_ENV__ does not exist!\" \u003e\u00262\n```\n\nFor a destination named `x\u0027$(id)\u0027y`, `shlex.quote` emits `\u0027x\u0027\"\u0027\"\u0027$(id)\u0027\"\u0027\"\u0027y\u0027`. The inner `\"` closes the enclosing double quote and `$(id)` is left unquoted. Backtick and `;` payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.\n\n`activate.fish` is affected through the interpreter\u0027s Tcl/Tk library paths:\n\n```fish\nset -gx TCL_LIBRARY \u0027__TCL_LIBRARY__\u0027\n```\n\n`shlex.quote` already returns `\u0027/tcl/(cmd)/lib\u0027`, so the rendered line is `\u0027\u0027/tcl/(cmd)/lib\u0027\u0027`. fish concatenates the adjacent quoted runs and expands the `(cmd)` left between them. The same doubling also splits a path containing a space into two list elements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.\n\nThis is the same defect class as GHSA-x78j-v8h9-3j2q, which covered `activate.bat`.\n\n### Patches\n\nFixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting `shlex.quote` applied. Fix: https://github.com/pypa/virtualenv/pull/3252\n\n### Workarounds\n\nAvoid creating or distributing virtual environments whose path contains `\u0027`, `` ` ``, `$`, `;`, `(` or `)`, and inspect the generated activation script before sourcing one you did not create.",
"id": "BREW-conda-lock-CVE-2026-102925",
"modified": "2026-10-06T17:55:36Z",
"published": "2026-10-04T15:51:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102925"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3252"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4013.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "virtualenv bash and fish activation scripts execute commands embedded in paths",
"upstream": [
"GHSA-p58f-9548-mpm2",
"CVE-2026-102925",
"PYSEC-2026-4013",
"BIT-virtualenv-2026-102925"
]
}
BREW-PIPENV-CVE-2026-102925 (GHSA-P58F-9548-MPM2)
Vulnerability from osv_homebrew – Published: 2026-10-04 15:51 – Updated: 2026-10-06 17:41 – Source websiteImpact
The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.
activate is affected through the virtual environment's own path, on the branch that reports a relocated environment:
echo "Virtual environment directory __VIRTUAL_ENV__ does not exist!" >&2
For a destination named x'$(id)'y, shlex.quote emits 'x'"'"'$(id)'"'"'y'. The inner " closes the enclosing double quote and $(id) is left unquoted. Backtick and ; payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.
activate.fish is affected through the interpreter's Tcl/Tk library paths:
set -gx TCL_LIBRARY '__TCL_LIBRARY__'
shlex.quote already returns '/tcl/(cmd)/lib', so the rendered line is ''/tcl/(cmd)/lib''. fish concatenates the adjacent quoted runs and expands the (cmd) left between them. The same doubling also splits a path containing a space into two list elements, corrupting TCL_LIBRARY and TK_LIBRARY.
This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered activate.bat.
Patches
Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting shlex.quote applied. Fix: https://github.com/pypa/virtualenv/pull/3252
Workarounds
Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.2",
"upstream_fixed_in": "21.7.13"
},
"package": {
"ecosystem": "Homebrew",
"name": "pipenv",
"purl": "pkg:brew/pipenv"
},
"ranges": [
{
"events": [
{
"introduced": "2025.0.4"
},
{
"fixed": "2026.8.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.2",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.2"
}
]
},
"details": "### Impact\n\nThe generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.\n\n`activate` is affected through the virtual environment\u0027s own path, on the branch that reports a relocated environment:\n\n```sh\necho \"Virtual environment directory __VIRTUAL_ENV__ does not exist!\" \u003e\u00262\n```\n\nFor a destination named `x\u0027$(id)\u0027y`, `shlex.quote` emits `\u0027x\u0027\"\u0027\"\u0027$(id)\u0027\"\u0027\"\u0027y\u0027`. The inner `\"` closes the enclosing double quote and `$(id)` is left unquoted. Backtick and `;` payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.\n\n`activate.fish` is affected through the interpreter\u0027s Tcl/Tk library paths:\n\n```fish\nset -gx TCL_LIBRARY \u0027__TCL_LIBRARY__\u0027\n```\n\n`shlex.quote` already returns `\u0027/tcl/(cmd)/lib\u0027`, so the rendered line is `\u0027\u0027/tcl/(cmd)/lib\u0027\u0027`. fish concatenates the adjacent quoted runs and expands the `(cmd)` left between them. The same doubling also splits a path containing a space into two list elements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.\n\nThis is the same defect class as GHSA-x78j-v8h9-3j2q, which covered `activate.bat`.\n\n### Patches\n\nFixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting `shlex.quote` applied. Fix: https://github.com/pypa/virtualenv/pull/3252\n\n### Workarounds\n\nAvoid creating or distributing virtual environments whose path contains `\u0027`, `` ` ``, `$`, `;`, `(` or `)`, and inspect the generated activation script before sourcing one you did not create.",
"id": "BREW-pipenv-CVE-2026-102925",
"modified": "2026-10-06T17:41:43Z",
"published": "2026-10-04T15:51:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102925"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3252"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4013.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "virtualenv bash and fish activation scripts execute commands embedded in paths",
"upstream": [
"GHSA-p58f-9548-mpm2",
"CVE-2026-102925",
"PYSEC-2026-4013",
"BIT-virtualenv-2026-102925"
]
}
BREW-TOX-CVE-2026-102925 (GHSA-P58F-9548-MPM2)
Vulnerability from osv_homebrew – Published: 2026-10-04 15:51 – Updated: 2026-10-06 17:44 – Source websiteImpact
The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.
activate is affected through the virtual environment's own path, on the branch that reports a relocated environment:
echo "Virtual environment directory __VIRTUAL_ENV__ does not exist!" >&2
For a destination named x'$(id)'y, shlex.quote emits 'x'"'"'$(id)'"'"'y'. The inner " closes the enclosing double quote and $(id) is left unquoted. Backtick and ; payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.
activate.fish is affected through the interpreter's Tcl/Tk library paths:
set -gx TCL_LIBRARY '__TCL_LIBRARY__'
shlex.quote already returns '/tcl/(cmd)/lib', so the rendered line is ''/tcl/(cmd)/lib''. fish concatenates the adjacent quoted runs and expands the (cmd) left between them. The same doubling also splits a path containing a space into two list elements, corrupting TCL_LIBRARY and TK_LIBRARY.
This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered activate.bat.
Patches
Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting shlex.quote applied. Fix: https://github.com/pypa/virtualenv/pull/3252
Workarounds
Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.5",
"upstream_fixed_in": "21.7.13"
},
"package": {
"ecosystem": "Homebrew",
"name": "tox",
"purl": "pkg:brew/tox"
},
"ranges": [
{
"events": [
{
"introduced": "4.28.4"
},
{
"fixed": "4.62.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.5",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.5"
}
]
},
"details": "### Impact\n\nThe generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.\n\n`activate` is affected through the virtual environment\u0027s own path, on the branch that reports a relocated environment:\n\n```sh\necho \"Virtual environment directory __VIRTUAL_ENV__ does not exist!\" \u003e\u00262\n```\n\nFor a destination named `x\u0027$(id)\u0027y`, `shlex.quote` emits `\u0027x\u0027\"\u0027\"\u0027$(id)\u0027\"\u0027\"\u0027y\u0027`. The inner `\"` closes the enclosing double quote and `$(id)` is left unquoted. Backtick and `;` payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.\n\n`activate.fish` is affected through the interpreter\u0027s Tcl/Tk library paths:\n\n```fish\nset -gx TCL_LIBRARY \u0027__TCL_LIBRARY__\u0027\n```\n\n`shlex.quote` already returns `\u0027/tcl/(cmd)/lib\u0027`, so the rendered line is `\u0027\u0027/tcl/(cmd)/lib\u0027\u0027`. fish concatenates the adjacent quoted runs and expands the `(cmd)` left between them. The same doubling also splits a path containing a space into two list elements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.\n\nThis is the same defect class as GHSA-x78j-v8h9-3j2q, which covered `activate.bat`.\n\n### Patches\n\nFixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting `shlex.quote` applied. Fix: https://github.com/pypa/virtualenv/pull/3252\n\n### Workarounds\n\nAvoid creating or distributing virtual environments whose path contains `\u0027`, `` ` ``, `$`, `;`, `(` or `)`, and inspect the generated activation script before sourcing one you did not create.",
"id": "BREW-tox-CVE-2026-102925",
"modified": "2026-10-06T17:44:07Z",
"published": "2026-10-04T15:51:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102925"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3252"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4013.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "virtualenv bash and fish activation scripts execute commands embedded in paths",
"upstream": [
"GHSA-p58f-9548-mpm2",
"CVE-2026-102925",
"PYSEC-2026-4013",
"BIT-virtualenv-2026-102925"
]
}
BREW-VIRTUALENV-CVE-2026… (CVE-2026-102925)
Vulnerability from osv_homebrew – Published: 2026-10-05 04:49 – Updated: 2026-10-06 18:32 – Source websitevirtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches VIRTUAL_ENV when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach TCL_LIBRARY or TK_LIBRARY. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "21.7.13"
},
"package": {
"ecosystem": "Homebrew",
"name": "virtualenv",
"purl": "pkg:brew/virtualenv"
},
"ranges": [
{
"events": [
{
"introduced": "20.33.0"
},
{
"fixed": "21.7.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "git",
"upstream_evidence": [
{
"ecosystem": "GIT",
"key": "https://github.com/pypa/virtualenv",
"name": "https://github.com/pypa/virtualenv",
"strategy": "git",
"subject_version": "21.14.5"
},
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.5",
"name": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.5"
},
{
"ecosystem": "Debian",
"key": "Debian/python-virtualenv",
"name": "python-virtualenv",
"strategy": "distro"
},
{
"ecosystem": "GIT",
"key": "upstream:https://github.com/pypa/virtualenv",
"name": "https://github.com/pypa/virtualenv",
"strategy": "distro",
"subject_version": "21.14.5"
},
{
"ecosystem": "PyPI",
"key": "upstream:pkg:pypi/virtualenv@21.14.5",
"name": "virtualenv",
"strategy": "distro",
"subject_version": "21.14.5"
},
{
"ecosystem": "Ubuntu",
"key": "Ubuntu/python-virtualenv",
"name": "python-virtualenv",
"strategy": "distro"
}
]
},
"details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment\u0027s recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user\u0027s privileges. This issue is fixed in version 21.7.13.",
"id": "BREW-virtualenv-CVE-2026-102925",
"modified": "2026-10-06T18:32:38Z",
"published": "2026-10-05T04:49:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
},
{
"type": "ADVISORY",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102925.json"
},
{
"type": "ADVISORY",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102925"
},
{
"type": "FIX",
"url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
},
{
"type": "FIX",
"url": "https://github.com/pypa/virtualenv/pull/3252"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "virtualenv bash and fish activation scripts execute commands embedded in paths",
"upstream": [
"CVE-2026-102925",
"GHSA-p58f-9548-mpm2",
"PYSEC-2026-4013",
"BIT-virtualenv-2026-102925"
]
}
BREW-VIRTUALFISH-CVE-202… (GHSA-P58F-9548-MPM2)
Vulnerability from osv_homebrew – Published: 2026-10-04 15:51 – Updated: 2026-10-06 18:25 – Source websiteImpact
The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.
activate is affected through the virtual environment's own path, on the branch that reports a relocated environment:
echo "Virtual environment directory __VIRTUAL_ENV__ does not exist!" >&2
For a destination named x'$(id)'y, shlex.quote emits 'x'"'"'$(id)'"'"'y'. The inner " closes the enclosing double quote and $(id) is left unquoted. Backtick and ; payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.
activate.fish is affected through the interpreter's Tcl/Tk library paths:
set -gx TCL_LIBRARY '__TCL_LIBRARY__'
shlex.quote already returns '/tcl/(cmd)/lib', so the rendered line is ''/tcl/(cmd)/lib''. fish concatenates the adjacent quoted runs and expands the (cmd) left between them. The same doubling also splits a path containing a space into two list elements, corrupting TCL_LIBRARY and TK_LIBRARY.
This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered activate.bat.
Patches
Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting shlex.quote applied. Fix: https://github.com/pypa/virtualenv/pull/3252
Workarounds
Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.5",
"upstream_fixed_in": "21.7.13"
},
"package": {
"ecosystem": "Homebrew",
"name": "virtualfish",
"purl": "pkg:brew/virtualfish"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.9_1"
},
{
"fixed": "2.5.9_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.5",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.5"
}
]
},
"details": "### Impact\n\nThe generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.\n\n`activate` is affected through the virtual environment\u0027s own path, on the branch that reports a relocated environment:\n\n```sh\necho \"Virtual environment directory __VIRTUAL_ENV__ does not exist!\" \u003e\u00262\n```\n\nFor a destination named `x\u0027$(id)\u0027y`, `shlex.quote` emits `\u0027x\u0027\"\u0027\"\u0027$(id)\u0027\"\u0027\"\u0027y\u0027`. The inner `\"` closes the enclosing double quote and `$(id)` is left unquoted. Backtick and `;` payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.\n\n`activate.fish` is affected through the interpreter\u0027s Tcl/Tk library paths:\n\n```fish\nset -gx TCL_LIBRARY \u0027__TCL_LIBRARY__\u0027\n```\n\n`shlex.quote` already returns `\u0027/tcl/(cmd)/lib\u0027`, so the rendered line is `\u0027\u0027/tcl/(cmd)/lib\u0027\u0027`. fish concatenates the adjacent quoted runs and expands the `(cmd)` left between them. The same doubling also splits a path containing a space into two list elements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.\n\nThis is the same defect class as GHSA-x78j-v8h9-3j2q, which covered `activate.bat`.\n\n### Patches\n\nFixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting `shlex.quote` applied. Fix: https://github.com/pypa/virtualenv/pull/3252\n\n### Workarounds\n\nAvoid creating or distributing virtual environments whose path contains `\u0027`, `` ` ``, `$`, `;`, `(` or `)`, and inspect the generated activation script before sourcing one you did not create.",
"id": "BREW-virtualfish-CVE-2026-102925",
"modified": "2026-10-06T18:25:41Z",
"published": "2026-10-04T15:51:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102925"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3252"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4013.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "virtualenv bash and fish activation scripts execute commands embedded in paths",
"upstream": [
"GHSA-p58f-9548-mpm2",
"CVE-2026-102925",
"PYSEC-2026-4013",
"BIT-virtualenv-2026-102925"
]
}
CVE-2026-102925 (GCVE-0-2026-102925)
Vulnerability from cvelistv5 – Published: 2026-09-29 20:50 – Updated: 2026-09-30 19:25- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
| URL | Tags |
|---|---|
| https://github.com/pypa/virtualenv/security/advis… | x_refsource_CONFIRM |
| https://github.com/pypa/virtualenv/pull/3252 | x_refsource_MISC |
| https://github.com/pypa/virtualenv/commit/4d5a105… | x_refsource_MISC |
| https://github.com/pypa/virtualenv/releases/tag/21.7.13 | x_refsource_MISC |
| Vendor | Product | Version | |
|---|---|---|---|
| pypa | virtualenv |
Affected:
< 21.7.13
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T19:24:23.430338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T19:25:16.653Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003c 21.7.13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment\u0027s recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user\u0027s privileges. This issue is fixed in version 21.7.13."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T20:50:57.199Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
},
{
"name": "https://github.com/pypa/virtualenv/pull/3252",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/pull/3252"
},
{
"name": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
},
{
"name": "https://github.com/pypa/virtualenv/releases/tag/21.7.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
}
],
"source": {
"advisory": "GHSA-p58f-9548-mpm2",
"discovery": "UNKNOWN"
},
"title": "virtualenv bash and fish activation scripts execute commands embedded in paths"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102925",
"datePublished": "2026-09-29T20:50:57.199Z",
"dateReserved": "2026-09-29T20:24:43.339Z",
"dateUpdated": "2026-09-30T19:25:16.653Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.