← Packages
python-virtualenv
Tool to create isolated Python environments
- Current
- 21.7.4
- Candidate
- 21.15.6Stale
- License
- MIT
RuntimeDeps
| Dependency | Observed source | Current requirement | Candidate requirement |
|---|---|---|---|
0.4.0 | |||
3.29.0 | |||
3.29.0 | |||
25.0 | Not observed | ||
4.9.6 | |||
1.6.1 | |||
4.16.0 | |||
3.14.9 |
Dependency conditions
- Applies when (any)
- python_version < "3.10"
- Applies when (any)
- python_version >= "3.10"
- Applies when (any)
- python_version < "3.11"
Advisory · 19
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before useOSV
- Summary
- Downloaded seed wheels (pip/setuptools) are not integrity-checked before useOSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.197%FIRST
- Returned advisory
- GHSA-94p9-xgh2-xp45OSV
- Returned advisory
- PYSEC-2026-4011OSV
- Aliases
- BIT-virtualenv-2026-102930, GHSA-94p9-xgh2-xp45, PYSEC-2026-4011OSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv: Command injection via --prompt in activate.bat (batch activator)OSV
- Summary
- Command injection via --prompt in activate.bat (batch activator)OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.208%FIRST
- Returned advisory
- GHSA-x78j-v8h9-3j2qOSV
- Returned advisory
- PYSEC-2026-4014OSV
- Aliases
- BIT-virtualenv-2026-102937, GHSA-x78j-v8h9-3j2q, PYSEC-2026-4014OSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injectionOSVOSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.146%FIRST
- Returned advisory
- GHSA-9h9j-4vrj-gf7gOSV
- Returned advisory
- PYSEC-2026-4012OSV
- Aliases
- BIT-virtualenv-2026-102938, GHSA-9h9j-4vrj-gf7g, PYSEC-2026-4012OSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv: Downloaded wheel selection and caching precede verificationOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.249%FIRST
- Returned advisory
- GHSA-494p-63j8-28p3OSV
- Aliases
- BIT-virtualenv-2026-113714, GHSA-494p-63j8-28p3OSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv: Venv configuration readback can reinterpret path boundariesOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.242%FIRST
- Returned advisory
- GHSA-qmx5-4p3x-wvqfOSV
- Aliases
- BIT-virtualenv-2026-113715, GHSA-qmx5-4p3x-wvqfOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv: Builtin creation follows linked environment directoriesOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.144%FIRST
- Returned advisory
- GHSA-cw65-gx24-rc82OSV
- Aliases
- BIT-virtualenv-2026-113716, GHSA-cw65-gx24-rc82OSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LOSV
- Summary
- virtualenv: Pip seeding with download omits wheel digest verificationOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.293%FIRST
- Returned advisory
- GHSA-cx28-75q4-x26qOSV
- Aliases
- BIT-virtualenv-2026-113717, GHSA-cx28-75q4-x26qOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv: Xonsh activation literals depend on the script decoding codecOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.242%FIRST
- Returned advisory
- GHSA-394h-qwmc-48pfOSV
- Aliases
- BIT-virtualenv-2026-113718, GHSA-394h-qwmc-48pfOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv: Seed replacement does not contain metadata deletion pathsOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.203%FIRST
- Returned advisory
- GHSA-hhxq-47xx-j5xxOSV
- Aliases
- BIT-virtualenv-2026-113719, GHSA-hhxq-47xx-j5xxOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LOSV
- Summary
- virtualenv: Seeded files retain permissions from an older cacheOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.134%FIRST
- Returned advisory
- GHSA-fc2g-4w5p-6whmOSV
- Aliases
- BIT-virtualenv-2026-113720, GHSA-fc2g-4w5p-6whmOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv: Generated files can follow existing destination linksOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.144%FIRST
- Returned advisory
- GHSA-558c-9hv2-4prjOSV
- Aliases
- BIT-virtualenv-2026-113721, GHSA-558c-9hv2-4prjOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LOSV
- Summary
- virtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.285%FIRST
- Returned advisory
- GHSA-c978-59m8-c77vOSV
- Aliases
- BIT-virtualenv-2026-113722, GHSA-c978-59m8-c77vOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOSV
- Summary
- virtualenv: Bash prompt values can change meaning under older compatibility modesOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.242%FIRST
- Returned advisory
- GHSA-6w3r-xr62-4xcpOSV
- Aliases
- BIT-virtualenv-2026-113723, GHSA-6w3r-xr62-4xcpOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NOSV
- Summary
- virtualenv: Deletion recovery can change a symlink target's modeOSV
- Fixed events
- 21.14.9OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.203%FIRST
- Returned advisory
- GHSA-43mp-35q3-x3fqOSV
- Aliases
- BIT-virtualenv-2026-113724, GHSA-43mp-35q3-x3fqOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LOSV
- Summary
- virtualenv bash activate runs commands from an environment name with a backslash before $OSV
- Fixed events
- 21.14.7OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.263%FIRST
- Returned advisory
- GHSA-vxj4-q4g9-crj7OSV
- Aliases
- BIT-virtualenv-2026-113725, GHSA-vxj4-q4g9-crj7OSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOSV
- Summary
- virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTOSV
- Fixed events
- 21.14.4OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.345%FIRST
- Returned advisory
- GHSA-5vjq-rrrf-7h2qOSV
- Aliases
- BIT-virtualenv-2026-113726, GHSA-5vjq-rrrf-7h2qOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOSV
- Summary
- virtualenv activate.fish runs commands from a path or prompt with a backslash before a quoteOSV
- Fixed events
- 21.14.2OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.236%FIRST
- Returned advisory
- GHSA-c947-3pg5-gm8qOSV
- Aliases
- BIT-virtualenv-2026-113732, GHSA-c947-3pg5-gm8qOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOSV
- Summary
- virtualenv activation scripts run code from a path that contains a placeholder nameOSV
- Fixed events
- 21.14.2OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.269%FIRST
- Returned advisory
- GHSA-8rjx-v5ww-45ppOSV
- Aliases
- BIT-virtualenv-2026-113776, GHSA-8rjx-v5ww-45ppOSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOSV
Description
virtualenv is a tool to create isolated Python environments. A subset of it has been integrated into the Python standard library under the venv module. The venv module does not offer all features of this library, to name just a few more prominent: - is slower (by not having the app-data seed method), - is not as extendable, - cannot create virtual environments for arbitrarily installed Python versions (and automatically discover these), - does not have as rich programmatic API (describe virtual environments without creating them).
Changelog
PR · 5
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Stale Repository refresh: git fetch exited 128 (authentication) | ||
Stale Source last confirmed at 2026-11-10T09:54:44+00:00; repository refresh overdue. | ||
Checked | ||
Checked | ||
Not configured No reliable monitor identity/configuration. | — | |
Checked Compared same-provider, same-project SPDX metadata for this version pair. | Last attempted | |
Checked | Last attempted | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Checked |