virtualenv has 8 CVEs on record. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 8. The median CVSS is 4.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-78 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.5
- Publish → KEV
- —
- Last 90 days
- 8 prev 0
Worst active — by depth score
CVE-2026-113776High· 7.8virtualenv activation scripts run code from a path that contains a placeholder name43CVE-2026-113725High· 7.8virtualenv bash activate runs commands from an environment name with a backslash before $43CVE-2026-115586High· 7.1virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regr…39CVE-2026-113717Low· 2.3virtualenv: Pip seeding with download omits wheel digest verification25CVE-2026-113721Medium· 4.5virtualenv: Generated files can follow existing destination links25
virtualenv vulnerabilities
CVEs affecting virtualenv, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-115586High· 7.1virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regr…
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
CVE-2026-113717Low· 2.3PoCvirtualenv: Pip seeding with download omits wheel digest verification
virtualenv: Pip seeding with download omits wheel digest verification
CVE-2026-113715Low· 2.0PoCvirtualenv: Venv configuration readback can reinterpret path boundaries
virtualenv: Venv configuration readback can reinterpret path boundaries
CVE-2026-113720Medium· 4.4virtualenv: Seeded files retain permissions from an older cache
virtualenv: Seeded files retain permissions from an older cache
CVE-2026-113721Medium· 4.5virtualenv: Generated files can follow existing destination links
virtualenv: Generated files can follow existing destination links
CVE-2026-113776High· 7.8virtualenv activation scripts run code from a path that contains a placeholder name
virtualenv activation scripts run code from a path that contains a placeholder name
CVE-2026-113716Medium· 4.5virtualenv: Builtin creation follows linked environment directories
virtualenv: Builtin creation follows linked environment directories
CVE-2026-113725High· 7.8virtualenv bash activate runs commands from an environment name with a backslash before $
virtualenv bash activate runs commands from an environment name with a backslash before $