| virtualenv: Temporary app-data can leave dangling seed package linksCVE-2026-113713 · GHSA-4F8H-VR72-P32C |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Pip seeding with download omits wheel digest verificationCVE-2026-113717 · GHSA-CX28-75Q4-X26Q |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| virtualenv: Downloaded wheel selection and caching precede verificationCVE-2026-113714 · GHSA-494P-63J8-28P3 |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| virtualenv: Xonsh activation literals depend on the script decoding codecCVE-2026-113718 · GHSA-394H-QWMC-48PF |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Seeded files retain permissions from an older cacheCVE-2026-113720 · GHSA-FC2G-4W5P-6WHM |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Bash prompt values can change meaning under older compatibility modesCVE-2026-113723 · GHSA-6W3R-XR62-4XCP |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Venv configuration readback can reinterpret path boundariesCVE-2026-113715 · GHSA-QMX5-4P3X-WVQF |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| virtualenv: Seed replacement does not contain metadata deletion pathsCVE-2026-113719 · GHSA-HHXQ-47XX-J5XX |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)CVE-2026-115586 · GHSA-CX6F-VJHG-G3CC |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Generated files can follow existing destination linksCVE-2026-113721 · GHSA-558C-9HV2-4PRJ |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Builtin creation follows linked environment directoriesCVE-2026-113716 · GHSA-CW65-GX24-RC82 |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Deletion recovery can change a symlink target's modeCVE-2026-113724 · GHSA-43MP-35Q3-X3FQ |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxCVE-2026-113722 · GHSA-C978-59M8-C77V |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv bash activate runs commands from an environment name with a backslash before $CVE-2026-113725 · GHSA-VXJ4-Q4G9-CRJ7 |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTCVE-2026-113726 · GHSA-5VJQ-RRRF-7H2Q |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv activate.fish runs commands from a path or prompt with a backslash before a quoteCVE-2026-113732 · GHSA-C947-3PG5-GM8Q |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv activation scripts run code from a path that contains a placeholder nameCVE-2026-113776 · GHSA-8RJX-V5WW-45PP |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before useCVE-2026-102930 · GHSA-94P9-XGH2-XP45Version ranges need review. |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Command injection via --prompt in activate.bat (batch activator)CVE-2026-102937 · GHSA-X78J-V8H9-3J2QVersion ranges need review. |
virtualenvRed Hat Ansible Automation Platform 2/ansible-automation-platform-25/ansible-dev-tools-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injectionCVE-2026-102938 · GHSA-9H9J-4VRJ-GF7GVersion ranges need review. |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
