Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package python3.11-virtualenv  (opens in a new tab)

Threat Intelligence

EPSS
0.14% (3rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PYTHON311VIRTUALENV-20412722
  • published3 Oct 2026
  • disclosed29 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 29 Sep 2026

NewCVE-2026-102937  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.11-virtualenv package and not the python3.11-virtualenv package as distributed by RHEL.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.