CVE catalog

CVE-2026-102925

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Sep 18, 2026, 4:37:14 AM UTC
Updated: Sep 29, 2026, 9:17:18 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.16% · Oct 25, 2026

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	python-virtualenv	sid	`21.5.1+ds-1`	vulnerable
Debian	python-virtualenv	forky	`21.5.1+ds-1`	vulnerable
Debian	python-virtualenv	trixie	`20.31.2+ds-1+deb13u1`	vulnerable
Debian	python-virtualenv	bookworm	`20.17.1+ds-1`	not affected
PyPI	virtualenv	Not reported	`21.7.13`	fixed
PyPI	virtualenv	Not reported	`21.7.13`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	python-virtualenv	source	sid	`(unfixed)`	not yet assigned	Not reported	[1149650]
Debian	python-virtualenv	source	forky	`(unfixed)`	not yet assigned	Not reported	[1149650]
Debian	python-virtualenv	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1149650]
Debian	python-virtualenv	source	bookworm	`Not affected`	unimportant	Not reported	[1149650]
PyPI	virtualenv	PyPI	Not reported	`21.7.13`	Not reported	PYSEC-2026-4013	Not reported
PyPI	virtualenv	PyPI	Not reported	`21.7.13`	Not reported	GHSA-P58F-9548-MPM2	Not reported

[Debian bug #1149650]

Notes

[trixie] python-virtualenv: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

[python3-virtualenv]Affected
Source package: [python-virtualenv]
Details (2)
- 20.31.2+ds-1+deb13u1 · all · trixie
  Affected
  nvd · python-virtualenv · debian · 13
- 20.31.2+ds-1+deb13u1 · all · trixie
  Affected
  nvd · python-virtualenv · debian · 13
[virtualenv]Affected
Source package: [python-virtualenv]
Details (2)
- 20.31.2+ds-1+deb13u1 · all · trixie
  Affected
  nvd · python-virtualenv · debian · 13
- 20.31.2+ds-1+deb13u1 · all · trixie
  Affected
  nvd · python-virtualenv · debian · 13

[Debian 12 (Bookworm)]

[python3-virtualenv]Not affected
Source package: [python-virtualenv]
Details (2)
- 20.17.1+ds-1 · all · bookworm
  Not affected
  nvd · python-virtualenv · debian · bookworm
- 20.17.1+ds-1 · all · bookworm
  Not affected
  nvd · python-virtualenv · debian · bookworm
[virtualenv]Not affected
Source package: [python-virtualenv]
Details (2)
- 20.17.1+ds-1 · all · bookworm
  Not affected
  nvd · python-virtualenv · debian · bookworm
- 20.17.1+ds-1 · all · bookworm
  Not affected
  nvd · python-virtualenv · debian · bookworm

Observed: Oct 23, 2026, 8:36:57 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]