pypi

virtualenv

31 Total advisories

31 Vulnerabilities

0 Malware

Dependency scanning

Check whether virtualenv is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

virtualenv

Vulnerabilities

virtualenv: Temporary app-data can leave dangling seed package links

virtualenv: Downloaded wheel selection and caching precede verification

virtualenv: Seeded files retain permissions from an older cache

virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv: Xonsh activation literals depend on the script decoding codec

virtualenv: Pip seeding with download omits wheel digest verification

virtualenv: Venv configuration readback can reinterpret path boundaries

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

virtualenv: Generated files can follow existing destination links

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

virtualenv: Deletion recovery can change a symlink target's mode

virtualenv: Builtin creation follows linked environment directories

virtualenv bash activate runs commands from an environment name with a backslash before $

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

virtualenv activation scripts run code from a path that contains a placeholder name

Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

Command injection via --prompt in activate.bat (batch activator)

virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv allows command injection through activation scripts for a virtual environment

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

CVE-2024-53899

CVE-2011-4617

Virtualenv Allows Symlink Attack on /tmp/

Browse more PyPI advisories

Start Securing