OPENSUSE-SU-2026:12372-1

Vulnerability from csaf_opensuse - Published: 2026-10-30 00:00 - Updated: 2026-10-31 17:18
Summary
python313-virtualenv-21.15.1-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: python313-virtualenv-21.15.1-1.1 on GA media
Description of the patch: These are all security issues fixed in the python313-virtualenv-21.15.1-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12372
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-113714
5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-113716
4.5 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Recommended 8 products, the same list as for CVE-2026-113714
Threats
Impact moderate
CVE-2026-113718
7 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2026-113714
Threats
Impact important
CVE-2026-113720
6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Affected products
Recommended 8 products, the same list as for CVE-2026-113714
Threats
Impact moderate
CVE-2026-113722
6.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2026-113714
Threats
Impact moderate
CVE-2026-113724
4.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Affected products
Recommended 8 products, the same list as for CVE-2026-113714
Threats
Impact moderate
CVE-2026-113726
7 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2026-113714
Threats
Impact important
CVE-2026-113732
7 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2026-113714
Threats
Impact important
CVE-2026-115586
7 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2026-113714
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://www.suse.com/security/cve/CVE-2026-113714/ self
https://www.suse.com/security/cve/CVE-2026-113716/ self
https://www.suse.com/security/cve/CVE-2026-113718/ self
https://www.suse.com/security/cve/CVE-2026-113720/ self
https://www.suse.com/security/cve/CVE-2026-113722/ self
https://www.suse.com/security/cve/CVE-2026-113724/ self
https://www.suse.com/security/cve/CVE-2026-113726/ self
https://www.suse.com/security/cve/CVE-2026-113732/ self
https://www.suse.com/security/cve/CVE-2026-115586/ self
https://www.suse.com/security/cve/CVE-2026-113714 external
https://bugzilla.suse.com/1287079 external
https://www.suse.com/security/cve/CVE-2026-113716 external
https://bugzilla.suse.com/1286949 external
https://www.suse.com/security/cve/CVE-2026-113718 external
https://bugzilla.suse.com/1286947 external
https://www.suse.com/security/cve/CVE-2026-113720 external
https://bugzilla.suse.com/1287057 external
https://www.suse.com/security/cve/CVE-2026-113722 external
https://bugzilla.suse.com/1287086 external
https://www.suse.com/security/cve/CVE-2026-113724 external
https://bugzilla.suse.com/1287194 external
https://www.suse.com/security/cve/CVE-2026-113726 external
https://bugzilla.suse.com/1287317 external
https://www.suse.com/security/cve/CVE-2026-113732 external
https://bugzilla.suse.com/1287319 external
https://www.suse.com/security/cve/CVE-2026-115586 external
https://bugzilla.suse.com/1288119 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python313-virtualenv-21.15.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python313-virtualenv-21.15.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12372",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12372-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-113714 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-113714/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-113716 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-113716/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-113718 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-113718/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-113720 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-113720/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-113722 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-113722/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-113724 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-113724/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-113726 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-113726/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-113732 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-113732/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-115586 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-115586/"
      }
    ],
    "title": "python313-virtualenv-21.15.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-31T17:18:46Z",
      "generator": {
        "date": "2026-10-30T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12372-1",
      "initial_release_date": "2026-10-30T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-30T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-31T17:18:46Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-virtualenv-0:21.15.1-1.1.aarch64",
                "product": {
                  "name": "python313-virtualenv-0:21.15.1-1.1.aarch64",
                  "product_id": "python313-virtualenv-0:21.15.1-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:virtualenv:virtualenv:21.15.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-virtualenv@21.15.1-1.1?arch=aarch64\u0026upstream=python-virtualenv-0:21.15.1-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-virtualenv-0:21.15.1-1.1.aarch64",
                "product": {
                  "name": "python314-virtualenv-0:21.15.1-1.1.aarch64",
                  "product_id": "python314-virtualenv-0:21.15.1-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-virtualenv@21.15.1-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-virtualenv-0:21.15.1-1.1.ppc64le",
                "product": {
                  "name": "python313-virtualenv-0:21.15.1-1.1.ppc64le",
                  "product_id": "python313-virtualenv-0:21.15.1-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:virtualenv:virtualenv:21.15.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-virtualenv@21.15.1-1.1?arch=ppc64le\u0026upstream=python-virtualenv-0:21.15.1-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-virtualenv-0:21.15.1-1.1.ppc64le",
                "product": {
                  "name": "python314-virtualenv-0:21.15.1-1.1.ppc64le",
                  "product_id": "python314-virtualenv-0:21.15.1-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-virtualenv@21.15.1-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-virtualenv-0:21.15.1-1.1.s390x",
                "product": {
                  "name": "python313-virtualenv-0:21.15.1-1.1.s390x",
                  "product_id": "python313-virtualenv-0:21.15.1-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:virtualenv:virtualenv:21.15.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-virtualenv@21.15.1-1.1?arch=s390x\u0026upstream=python-virtualenv-0:21.15.1-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-virtualenv-0:21.15.1-1.1.s390x",
                "product": {
                  "name": "python314-virtualenv-0:21.15.1-1.1.s390x",
                  "product_id": "python314-virtualenv-0:21.15.1-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-virtualenv@21.15.1-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-virtualenv-0:21.15.1-1.1.x86_64",
                "product": {
                  "name": "python313-virtualenv-0:21.15.1-1.1.x86_64",
                  "product_id": "python313-virtualenv-0:21.15.1-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:virtualenv:virtualenv:21.15.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-virtualenv@21.15.1-1.1?arch=x86_64\u0026upstream=python-virtualenv-0:21.15.1-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-virtualenv-0:21.15.1-1.1.x86_64",
                "product": {
                  "name": "python314-virtualenv-0:21.15.1-1.1.x86_64",
                  "product_id": "python314-virtualenv-0:21.15.1-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-virtualenv@21.15.1-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-virtualenv-0:21.15.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64"
        },
        "product_reference": "python313-virtualenv-0:21.15.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-virtualenv-0:21.15.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le"
        },
        "product_reference": "python313-virtualenv-0:21.15.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-virtualenv-0:21.15.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x"
        },
        "product_reference": "python313-virtualenv-0:21.15.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-virtualenv-0:21.15.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64"
        },
        "product_reference": "python313-virtualenv-0:21.15.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-virtualenv-0:21.15.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64"
        },
        "product_reference": "python314-virtualenv-0:21.15.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-virtualenv-0:21.15.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le"
        },
        "product_reference": "python314-virtualenv-0:21.15.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-virtualenv-0:21.15.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x"
        },
        "product_reference": "python314-virtualenv-0:21.15.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-virtualenv-0:21.15.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        },
        "product_reference": "python314-virtualenv-0:21.15.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-113714",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-113714"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip\u0027s textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link\u0027s data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without verification. A separate rejected-cache-file variant requires control over downloaded data or archive selection but not the forged-line prerequisites. Explicit custom-index exceptions are outside the promised PyPI comparison, and the issue does not independently bypass TLS or establish control of default PyPI. This issue is fixed in version 21.14.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-113714",
          "url": "https://www.suse.com/security/cve/CVE-2026-113714"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287079 for CVE-2026-113714",
          "url": "https://bugzilla.suse.com/1287079"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-113714"
    },
    {
      "cve": "CVE-2026-113716",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-113716"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination when another local account prepared the tree and the invoking user can access the target. The --clear option removes the planted tree first, while ordinary creation reaches it; arbitrary attacker-selected output bytes are not established. This issue is fixed in version 21.14.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-113716",
          "url": "https://www.suse.com/security/cve/CVE-2026-113716"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286949 for CVE-2026-113716",
          "url": "https://bugzilla.suse.com/1286949"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-113716"
    },
    {
      "cve": "CVE-2026-113718",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-113718"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-113718",
          "url": "https://www.suse.com/security/cve/CVE-2026-113718"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286947 for CVE-2026-113718",
          "url": "https://bugzilla.suse.com/1286947"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-113718"
    },
    {
      "cve": "CVE-2026-113720",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-113720"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run\u0027s umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-113720",
          "url": "https://www.suse.com/security/cve/CVE-2026-113720"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287057 for CVE-2026-113720",
          "url": "https://bugzilla.suse.com/1287057"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-113720"
    },
    {
      "cve": "CVE-2026-113722",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-113722"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv\u0027s ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user\u0027s privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip\u0027s vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-113722",
          "url": "https://www.suse.com/security/cve/CVE-2026-113722"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287086 for CVE-2026-113722",
          "url": "https://bugzilla.suse.com/1287086"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-113722"
    },
    {
      "cve": "CVE-2026-113724",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-113724"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can therefore cause a victim-owned target outside the destination that is initially not writable by the invoking user to become broadly writable before the retry fails, provided that user owns the target and can change its mode. Another account can use the widened mode only if it can traverse the target\u0027s parent directories; root does not reach the demonstrated failure path, and the operation does not itself read the target. This issue is fixed in version 21.14.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-113724",
          "url": "https://www.suse.com/security/cve/CVE-2026-113724"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287194 for CVE-2026-113724",
          "url": "https://bugzilla.suse.com/1287194"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-113724"
    },
    {
      "cve": "CVE-2026-113726",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-113726"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value. The script assigns that value to PS1. In zsh with PROMPT_SUBST, an attacker-influenced environment directory, --prompt, or VIRTUALENV_PROMPT value containing command, parameter, or arithmetic expansion syntax can therefore execute commands in the user\u0027s shell each time the prompt is drawn. A percent sign is separately interpreted as a zsh prompt escape but does not by itself execute commands. Plain zsh with PROMPT_SUBST disabled and bash are not affected by this mechanism. This issue is fixed in version 21.14.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-113726",
          "url": "https://www.suse.com/security/cve/CVE-2026-113726"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287317 for CVE-2026-113726",
          "url": "https://bugzilla.suse.com/1287317"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-113726"
    },
    {
      "cve": "CVE-2026-113732",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-113732"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-113732",
          "url": "https://www.suse.com/security/cve/CVE-2026-113732"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287319 for CVE-2026-113732",
          "url": "https://bugzilla.suse.com/1287319"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-113732"
    },
    {
      "cve": "CVE-2026-115586",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-115586"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-115586",
          "url": "https://www.suse.com/security/cve/CVE-2026-115586"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1288119 for CVE-2026-115586",
          "url": "https://bugzilla.suse.com/1288119"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-virtualenv-0:21.15.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-virtualenv-0:21.15.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-115586"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.