Skip to content
Heist/ feed
High

DEBIAN-CVE-2026-102925

Type: advisorySource: OSV1 source record

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-102925

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-102925

python-virtualenv

Source reference: /affected/0/package/name

Affected versions
20.31.2+ds-1

Source reference: /affected/0/versions

20.31.2+ds-1+deb13u1

Source reference: /affected/0/versions

20.33.1+ds-1

Source reference: /affected/0/versions

20.34.0+ds-1

Source reference: /affected/0/versions

20.35.3+ds-1

Source reference: /affected/0/versions

20.35.4+ds-1

Source reference: /affected/0/versions

20.36.1+ds-1

Source reference: /affected/0/versions

20.38.0+ds-1

Source reference: /affected/0/versions

21.2.0+ds-1

Source reference: /affected/0/versions

21.2.4+ds-1

Source reference: /affected/0/versions

21.3.1+ds-1

Source reference: /affected/0/versions

21.4.1+ds-1

Source reference: /affected/0/versions

21.5.1+ds-1

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

python-virtualenv

Source reference: /affected/1/package/name

Affected versions
20.31.2+ds-1

Source reference: /affected/1/versions

20.33.1+ds-1

Source reference: /affected/1/versions

20.34.0+ds-1

Source reference: /affected/1/versions

20.35.3+ds-1

Source reference: /affected/1/versions

20.35.4+ds-1

Source reference: /affected/1/versions

20.36.1+ds-1

Source reference: /affected/1/versions

20.38.0+ds-1

Source reference: /affected/1/versions

21.2.0+ds-1

Source reference: /affected/1/versions

21.2.4+ds-1

Source reference: /affected/1/versions

21.3.1+ds-1

Source reference: /affected/1/versions

21.4.1+ds-1

Source reference: /affected/1/versions

21.5.1+ds-1

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "python-virtualenv",
      "purl": "pkg:deb/debian/python-virtualenv?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "20.31.2+ds-1",
      "20.31.2+ds-1+deb13u1",
      "20.33.1+ds-1",
      "20.34.0+ds-1",
      "20.35.3+ds-1",
      "20.35.4+ds-1",
      "20.36.1+ds-1",
      "20.38.0+ds-1",
      "21.2.0+ds-1",
      "21.2.4+ds-1",
      "21.3.1+ds-1",
      "21.4.1+ds-1",
      "21.5.1+ds-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102925.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "python-virtualenv",
      "purl": "pkg:deb/debian/python-virtualenv?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "20.31.2+ds-1",
      "20.33.1+ds-1",
      "20.34.0+ds-1",
      "20.35.3+ds-1",
      "20.35.4+ds-1",
      "20.36.1+ds-1",
      "20.38.0+ds-1",
      "21.2.0+ds-1",
      "21.2.4+ds-1",
      "21.3.1+ds-1",
      "21.4.1+ds-1",
      "21.5.1+ds-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102925.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]
Related CVEs
CVE-2026-102925

Source reference: /upstream

Publisher severity

high

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102925 · High

virtualenv

Event
#81616 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement