Vulnerabilities for virtualenv

First version without a known vulnerability: 21.7.13

Details

• GHSA-p58f-9548-mpm22026-10-01

  virtualenv bash and fish activation scripts execute commands embedded in paths

  Fixed in: 21.7.13

• GHSA-x78j-v8h9-3j2q2026-10-01

  virtualenv: Command injection via --prompt in activate.bat (batch activator)

  Fixed in: 21.7.12

• GHSA-94p9-xgh2-xp452026-09-30

  virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

  Fixed in: 21.7.12

• GHSA-9h9j-4vrj-gf7g2026-09-30

  virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

  Fixed in: 21.7.11

• GHSA-597g-3phw-69862026-01-13

  virtualenv Has TOCTOU Vulnerabilities in Directory Creation

  Fixed in: 20.36.1

• GHSA-rqc4-2hc7-8c8v2024-11-24

  virtualenv allows command injection through activation scripts for a virtual environment

  Fixed in: 20.26.6

• GHSA-3jhc-wjqf-5f2c2022-05-17

  Virtualenv Allows Symlink Attack on /tmp/

  Fixed in: 1.5