Ppypa

Products

Exploited and recent CVEs

• CVE-2026-115586 High 7.1 virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) 0.3%
• CVE-2026-113726 High 7.8 virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST 0.3%
• CVE-2026-113776 High 7.8 virtualenv activation scripts run code from a path that contains a placeholder name 0.3%
• CVE-2026-113732 High 7.8 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote 0.2%
• CVE-2026-113725 High 7.8 virtualenv bash activate runs commands from an environment name with a backslash before $ 0.3%
• CVE-2026-113724 Medium 4.5 virtualenv: Deletion recovery can change a symlink target's mode 0.2%
• CVE-2026-113723 High 7.1 virtualenv: Bash prompt values can change meaning under older compatibility modes 0.2%
• CVE-2026-113722 High 7.8 virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax 0.3%
• CVE-2026-113721 Medium 4.5 virtualenv: Generated files can follow existing destination links 0.1%
• CVE-2026-113720 Medium 4.4 virtualenv: Seeded files retain permissions from an older cache 0.1%
• CVE-2026-113715 Low 2.0 virtualenv: Venv configuration readback can reinterpret path boundaries 0.2%
• CVE-2026-113719 Medium 4.5 virtualenv: Seed replacement does not contain metadata deletion paths 0.2%
• CVE-2026-113718 High 7.1 virtualenv: Xonsh activation literals depend on the script decoding codec 0.2%
• CVE-2026-113717 Low 2.3 virtualenv: Pip seeding with download omits wheel digest verification 0.3%
• CVE-2026-113716 Medium 4.5 virtualenv: Builtin creation follows linked environment directories 0.1%
• CVE-2026-113714 Low 2.3 virtualenv: Downloaded wheel selection and caching precede verification 0.2%
• CVE-2026-113713 Medium 4.4 virtualenv: Temporary app-data can leave dangling seed package links 0.2%
• CVE-2026-102938 Medium 5.8 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection 0.1%
• CVE-2026-102937 High 7.3 virtualenv: Command injection via --prompt in activate.bat (batch activator) 0.2%
• CVE-2026-102930 High 7.7 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use 0.2%
• CVE-2026-102925 High 7.8 virtualenv bash and fish activation scripts execute commands embedded in paths 0.2%
• CVE-2026-59890 Medium 6.1 setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ 0.4%
• CVE-2026-24049 High 7.1 wheel Allows Arbitrary File Permission Modification via Path Traversal 0.4%
• CVE-2026-22702 Medium 4.5 virtualenv Has TOCTOU Vulnerabilities in Directory Creation 0.1%
• CVE-2025-47273 High 7.7 setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write 1.6%
• CVE-2024-6345 High 8.8 Remote Code Execution in pypa/setuptools 1.9%
• CVE-2022-21668 High 8.0 Pipenv's requirements.txt parsing allows malicious index url in comments 3.9%