pypa vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20241
3. 20251
4. 202624

Newest CVEs

• CVE-2026-115586

  virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

  pypa · virtualenv

  High7.1
• CVE-2026-113726

  virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

  pypa · virtualenv

  High7.8
• CVE-2026-113776

  virtualenv activation scripts run code from a path that contains a placeholder name

  pypa · virtualenv

  High7.8
• CVE-2026-113732

  virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

  pypa · virtualenv

  High7.8
• CVE-2026-113725

  virtualenv bash activate runs commands from an environment name with a backslash before $

  pypa · virtualenv

  High7.8
• CVE-2026-113724

  virtualenv: Deletion recovery can change a symlink target's mode

  pypa · virtualenv

  Medium4.5
• CVE-2026-113723

  virtualenv: Bash prompt values can change meaning under older compatibility modes

  pypa · virtualenv

  High7.1
• CVE-2026-113722

  virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

  pypa · virtualenv

  High7.8
• CVE-2026-113721

  virtualenv: Generated files can follow existing destination links

  pypa · virtualenv

  Medium4.5
• CVE-2026-113720

  virtualenv: Seeded files retain permissions from an older cache

  pypa · virtualenv

  Medium4.4