CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.

• CWE-78

• https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6Patch
• https://github.com/pypa/virtualenv/pull/3252Issue Tracking, Patch
• https://github.com/pypa/virtualenv/releases/tag/21.7.13Release Notes
• https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2Patch, Vendor Advisory, Mitigation

Published

Sep 29, 2026

Last Modified

Nov 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102915Subscriber Broken Access Control in WPO365 <= 44.1 versions.8.5
• CVE-2026-102916A reachable assertion in the illumos bhyve instruction emula…6.8
• CVE-2026-102917IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticat…7.8
• CVE-2026-102918The Redux Framework plugin for WordPress is vulnerable to St…6.4
• CVE-2026-10292A vulnerability was detected in UTT HiPER 1200GW up to 2.5.3…8.8
• CVE-2026-102923SparkyFitness is a self-hosted, AI-powered health and fitnes…5.4
• CVE-2026-102927HedgeDoc is an open source, real-time collaborative markdown…5.9
• CVE-2026-10293A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306…8.8
• CVE-2026-102930virtualenv is a tool for creating isolated virtual python en…7.7
• CVE-2026-102937virtualenv is a tool for creating isolated virtual python en…7.3
• CVE-2026-102938virtualenv is a tool for creating isolated virtual python en…5.8
• CVE-2026-10294A vulnerability has been found in PackageKit up to 1.3.5. Af…4.3