https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 11:41:17 +0000 https://db.gcve.eu/vuln/cve-2026-102937 <p><strong>Affected:</strong> pypa virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set &#34;VAR=value&#34; statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user&#39;s privileges. This issue is fixed in version 21.7.12.</p> <p><strong>Affected:</strong> pypa virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set &#34;VAR=value&#34; statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user&#39;s privileges. This issue is fixed in version 21.7.12.</p> https://db.gcve.eu/vuln/cve-2026-102937