{"matches":[{"vulnerability":{"id":"GHSA-38jv-5279-wg99","dataSource":"https://github.com/advisories/GHSA-38jv-5279-wg99","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99","https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b","https://nvd.nist.gov/vuln/detail/CVE-2026-21441","https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"],"description":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21441","epss":0.02922,"percentile":0.87044,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-21441","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-21441","cwe":"CWE-409","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["2.6.3"],"state":"fixed","available":[{"version":"2.6.3","date":"2026-01-08","kind":"first-observed"}]},"advisories":[],"risk":2.29377},"relatedVulnerabilities":[{"id":"CVE-2026-21441","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b","https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99","https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html","https://access.redhat.com/errata/RHSA-2026:0981","https://access.redhat.com/errata/RHSA-2026:0990","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:1038","https://access.redhat.com/errata/RHSA-2026:1041","https://access.redhat.com/errata/RHSA-2026:1042","https://access.redhat.com/errata/RHSA-2026:1086","https://access.redhat.com/errata/RHSA-2026:1087","https://access.redhat.com/errata/RHSA-2026:1088","https://access.redhat.com/errata/RHSA-2026:1089","https://access.redhat.com/errata/RHSA-2026:1166","https://access.redhat.com/errata/RHSA-2026:1168","https://access.redhat.com/errata/RHSA-2026:1176","https://access.redhat.com/errata/RHSA-2026:1224","https://access.redhat.com/errata/RHSA-2026:1226","https://access.redhat.com/errata/RHSA-2026:1239","https://access.redhat.com/errata/RHSA-2026:1240","https://access.redhat.com/errata/RHSA-2026:1241","https://access.redhat.com/errata/RHSA-2026:1254","https://access.redhat.com/errata/RHSA-2026:1485","https://access.redhat.com/errata/RHSA-2026:14877","https://access.redhat.com/errata/RHSA-2026:1504","https://access.redhat.com/errata/RHSA-2026:1546","https://access.redhat.com/errata/RHSA-2026:1596","https://access.redhat.com/errata/RHSA-2026:1599","https://access.redhat.com/errata/RHSA-2026:1609","https://access.redhat.com/errata/RHSA-2026:1618","https://access.redhat.com/errata/RHSA-2026:1619","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:1674","https://access.redhat.com/errata/RHSA-2026:1676","https://access.redhat.com/errata/RHSA-2026:1693","https://access.redhat.com/errata/RHSA-2026:1704","https://access.redhat.com/errata/RHSA-2026:1706","https://access.redhat.com/errata/RHSA-2026:1712","https://access.redhat.com/errata/RHSA-2026:1717","https://access.redhat.com/errata/RHSA-2026:1726","https://access.redhat.com/errata/RHSA-2026:1729","https://access.redhat.com/errata/RHSA-2026:1730","https://access.redhat.com/errata/RHSA-2026:1734","https://access.redhat.com/errata/RHSA-2026:1735","https://access.redhat.com/errata/RHSA-2026:1736","https://access.redhat.com/errata/RHSA-2026:17456","https://access.redhat.com/errata/RHSA-2026:17457","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17461","https://access.redhat.com/errata/RHSA-2026:17462","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:1791","https://access.redhat.com/errata/RHSA-2026:1792","https://access.redhat.com/errata/RHSA-2026:1793","https://access.redhat.com/errata/RHSA-2026:1794","https://access.redhat.com/errata/RHSA-2026:1803","https://access.redhat.com/errata/RHSA-2026:1805","https://access.redhat.com/errata/RHSA-2026:1942","https://access.redhat.com/errata/RHSA-2026:1957","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2106","https://access.redhat.com/errata/RHSA-2026:2126","https://access.redhat.com/errata/RHSA-2026:2137","https://access.redhat.com/errata/RHSA-2026:2139","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2256","https://access.redhat.com/errata/RHSA-2026:2456","https://access.redhat.com/errata/RHSA-2026:2500","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:2563","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2695","https://access.redhat.com/errata/RHSA-2026:2717","https://access.redhat.com/errata/RHSA-2026:2718","https://access.redhat.com/errata/RHSA-2026:2723","https://access.redhat.com/errata/RHSA-2026:2728","https://access.redhat.com/errata/RHSA-2026:2760","https://access.redhat.com/errata/RHSA-2026:2762","https://access.redhat.com/errata/RHSA-2026:2764","https://access.redhat.com/errata/RHSA-2026:2765","https://access.redhat.com/errata/RHSA-2026:28043","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2911","https://access.redhat.com/errata/RHSA-2026:2919","https://access.redhat.com/errata/RHSA-2026:2924","https://access.redhat.com/errata/RHSA-2026:2925","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:3406","https://access.redhat.com/errata/RHSA-2026:3444","https://access.redhat.com/errata/RHSA-2026:3461","https://access.redhat.com/errata/RHSA-2026:3462","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:4185","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:4215","https://access.redhat.com/errata/RHSA-2026:4271","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:44696","https://access.redhat.com/errata/RHSA-2026:51357","https://access.redhat.com/errata/RHSA-2026:5459","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:6287","https://access.redhat.com/errata/RHSA-2026:6292","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8500","https://access.redhat.com/errata/RHSA-2026:8501","https://access.redhat.com/security/cve/CVE-2026-21441","https://bugzilla.redhat.com/show_bug.cgi?id=2427726","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21441.json"],"description":"urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21441","epss":0.02922,"percentile":0.87044,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-21441","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-21441","cwe":"CWE-409","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-38jv-5279-wg99","versionConstraint":">=1.22,<2.6.3 (python)"},"fix":{"suggestedVersion":"2.6.3"}}],"artifact":{"id":"pkg:pypi/urllib3@2.1.0?package-id=960fd57f59138971","name":"urllib3","version":"2.1.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rqc4-2hc7-8c8v","dataSource":"https://github.com/advisories/GHSA-rqc4-2hc7-8c8v","namespace":"github:language:python","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-53899","https://github.com/pypa/virtualenv/issues/2768","https://github.com/pypa/virtualenv/pull/2771","https://github.com/pypa/virtualenv/releases/tag/20.26.6","https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2024-187.yaml"],"description":"virtualenv allows command injection through activation scripts for a virtual environment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-53899","epss":0.01572,"percentile":0.75407,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-53899","cwe":"CWE-77","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2024-53899","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.26.6"],"state":"fixed","available":[{"version":"20.26.6","date":"2025-01-14","kind":"first-observed"}]},"advisories":[],"risk":1.2497400000000003},"relatedVulnerabilities":[{"id":"CVE-2024-53899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-53899","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/issues/2768","https://github.com/pypa/virtualenv/pull/2771","https://github.com/pypa/virtualenv/releases/tag/20.26.6"],"description":"virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-53899","epss":0.01572,"percentile":0.75407,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-53899","cwe":"CWE-77","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2024-53899","cwe":"CWE-78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-rqc4-2hc7-8c8v","versionConstraint":"<20.26.6 (python)"},"fix":{"suggestedVersion":"20.26.6"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2xpw-w6gg-jr37","dataSource":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37","https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7","https://nvd.nist.gov/vuln/detail/CVE-2025-66471","https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c","https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml","https://github.com/urllib3/urllib3","https://pypi.org/project/urllib3"],"description":"urllib3 streaming API improperly handles highly compressed data","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66471","epss":0.00682,"percentile":0.52479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66471","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.0"],"state":"fixed","available":[{"version":"2.6.0","date":"2025-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.55924},"relatedVulnerabilities":[{"id":"CVE-2025-66471","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7","https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"],"description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66471","epss":0.00682,"percentile":0.52479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66471","cwe":"CWE-409","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-2xpw-w6gg-jr37","versionConstraint":">=1.0,<2.6.0 (python)"},"fix":{"suggestedVersion":"2.6.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.1.0?package-id=960fd57f59138971","name":"urllib3","version":"2.1.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-gm62-xv2j-4w53","dataSource":"https://github.com/advisories/GHSA-gm62-xv2j-4w53","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53","https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8","https://nvd.nist.gov/vuln/detail/CVE-2025-66418"],"description":"urllib3 allows an unbounded number of links in the decompression chain","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66418","epss":0.00682,"percentile":0.52479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66418","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.0"],"state":"fixed","available":[{"version":"2.6.0","date":"2025-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.55924},"relatedVulnerabilities":[{"id":"CVE-2025-66418","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8","https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"],"description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-66418","epss":0.00682,"percentile":0.52479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-66418","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-gm62-xv2j-4w53","versionConstraint":">=1.24,<2.6.0 (python)"},"fix":{"suggestedVersion":"2.6.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.1.0?package-id=960fd57f59138971","name":"urllib3","version":"2.1.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-34jh-p97f-mpxf","dataSource":"https://github.com/advisories/GHSA-34jh-p97f-mpxf","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf","https://nvd.nist.gov/vuln/detail/CVE-2024-37891","https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468","https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html","https://security.netapp.com/advisory/ntap-20240822-0003","https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891"],"description":"urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37891","epss":0.01141,"percentile":0.66662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-37891","cwe":"CWE-669","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.2.2"],"state":"fixed","available":[{"version":"2.2.2","date":"2024-06-18","kind":"first-observed"}]},"advisories":[],"risk":0.53627},"relatedVulnerabilities":[{"id":"CVE-2024-37891","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37891","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e","https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf","https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html","https://security.netapp.com/advisory/ntap-20240822-0003/","https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891"],"description":"urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as mitigations.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37891","epss":0.01141,"percentile":0.66662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-37891","cwe":"CWE-669","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-34jh-p97f-mpxf","versionConstraint":">=2.0.0,<2.2.2 (python)"},"fix":{"suggestedVersion":"2.2.2"}}],"artifact":{"id":"pkg:pypi/urllib3@2.1.0?package-id=960fd57f59138971","name":"urllib3","version":"2.1.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9hjg-9r4m-mvj7","dataSource":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7","https://nvd.nist.gov/vuln/detail/CVE-2024-47081","https://github.com/psf/requests/pull/6965","https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef","https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env","https://seclists.org/fulldisclosure/2025/Jun/2","http://www.openwall.com/lists/oss-security/2025/06/03/11","http://www.openwall.com/lists/oss-security/2025/06/03/9","http://www.openwall.com/lists/oss-security/2025/06/04/1","http://www.openwall.com/lists/oss-security/2025/06/04/6","https://github.com/psf/requests","https://github.com/psf/requests/releases/tag/v2.32.4","https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2026-1872.yaml","https://pypi.org/project/requests"],"description":"Requests vulnerable to .netrc credentials leak via malicious URLs","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47081","epss":0.0098,"percentile":0.62222,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47081","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.32.4"],"state":"fixed","available":[{"version":"2.32.4","date":"2025-06-10","kind":"first-observed"}]},"advisories":[],"risk":0.5047},"relatedVulnerabilities":[{"id":"CVE-2024-47081","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef","https://github.com/psf/requests/pull/6965","https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7","https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env","https://seclists.org/fulldisclosure/2025/Jun/2","http://seclists.org/fulldisclosure/2025/Jun/2","http://www.openwall.com/lists/oss-security/2025/06/03/11","http://www.openwall.com/lists/oss-security/2025/06/03/9","http://www.openwall.com/lists/oss-security/2025/06/04/1","http://www.openwall.com/lists/oss-security/2025/06/04/6"],"description":"Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47081","epss":0.0098,"percentile":0.62222,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47081","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"requests","version":"2.31.0"}},"found":{"vulnerabilityID":"GHSA-9hjg-9r4m-mvj7","versionConstraint":"<2.32.4 (python)"},"fix":{"suggestedVersion":"2.32.4"}}],"artifact":{"id":"pkg:pypi/requests@2.31.0?package-id=b6832aab2298525d","name":"requests","version":"2.31.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:requests:2.31.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/requests@2.31.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-248v-346w-9cwc","dataSource":"https://github.com/advisories/GHSA-248v-346w-9cwc","namespace":"github:language:python","severity":"Low","urls":["https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc","https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463","https://nvd.nist.gov/vuln/detail/CVE-2024-39689","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI","https://security.netapp.com/advisory/ntap-20241206-0001","https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml"],"description":"Certifi removes GLOBALTRUST root certificate","cvss":[],"epss":[{"cve":"CVE-2024-39689","epss":0.01049,"percentile":0.64253,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-39689","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-39689","cwe":"CWE-345","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2024.7.4"],"state":"fixed","available":[{"version":"2024.7.4","date":"2025-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.3147},"relatedVulnerabilities":[{"id":"CVE-2024-39689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-39689","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463","https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI","https://security.netapp.com/advisory/ntap-20241206-0001/"],"description":"Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-39689","epss":0.01049,"percentile":0.64253,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-39689","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-39689","cwe":"CWE-345","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"certifi","version":"2023.11.17"}},"found":{"vulnerabilityID":"GHSA-248v-346w-9cwc","versionConstraint":">=2021.5.30,<2024.7.4 (python)"},"fix":{"suggestedVersion":"2024.7.4"}}],"artifact":{"id":"pkg:pypi/certifi@2023.11.17?package-id=1834cb1629eb62ba","name":"certifi","version":"2023.11.17","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:certifi:certifi:2023.11.17:*:*:*:*:python:*:*"],"purl":"pkg:pypi/certifi@2023.11.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxq7-64xx-v4gw","dataSource":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.27470000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-97689","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97689","epss":0.00335,"percentile":0.26859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-vxq7-64xx-v4gw","versionConstraint":">=1.10.3,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.1.0?package-id=960fd57f59138971","name":"urllib3","version":"2.1.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5vjq-rrrf-7h2q","dataSource":"https://github.com/advisories/GHSA-5vjq-rrrf-7h2q","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q","https://nvd.nist.gov/vuln/detail/CVE-2026-113726","https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2","https://github.com/pypa/virtualenv/releases/tag/21.14.4"],"description":"virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113726","epss":0.00345,"percentile":0.28047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113726","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-113726","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.4"],"state":"fixed","available":[{"version":"21.14.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.263925},"relatedVulnerabilities":[{"id":"CVE-2026-113726","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113726","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2","https://github.com/pypa/virtualenv/releases/tag/21.14.4","https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value. The script assigns that value to PS1. In zsh with PROMPT_SUBST, an attacker-influenced environment directory, --prompt, or VIRTUALENV_PROMPT value containing command, parameter, or arithmetic expansion syntax can therefore execute commands in the user's shell each time the prompt is drawn. A percent sign is separately interpreted as a zsh prompt escape but does not by itself execute commands. Plain zsh with PROMPT_SUBST disabled and bash are not affected by this mechanism. This issue is fixed in version 21.14.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113726","epss":0.00345,"percentile":0.28047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113726","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-113726","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-5vjq-rrrf-7h2q","versionConstraint":"<=21.14.3 (python)"},"fix":{"suggestedVersion":"21.14.4"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-pq67-6m6q-mj2v","dataSource":"https://github.com/advisories/GHSA-pq67-6m6q-mj2v","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v","https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857","https://nvd.nist.gov/vuln/detail/CVE-2025-50181","https://github.com/urllib3/urllib3/releases/tag/2.5.0"],"description":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-50181","epss":0.00474,"percentile":0.40995,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.5.0"],"state":"fixed","available":[{"version":"2.5.0","date":"2025-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.24411000000000002},"relatedVulnerabilities":[{"id":"CVE-2025-50181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857","https://github.com/urllib3/urllib3/releases/tag/2.5.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"],"description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-50181","epss":0.00474,"percentile":0.40995,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-50181","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-pq67-6m6q-mj2v","versionConstraint":"<2.5.0 (python)"},"fix":{"suggestedVersion":"2.5.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.1.0?package-id=960fd57f59138971","name":"urllib3","version":"2.1.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qccp-gfcp-xxvc","dataSource":"https://github.com/advisories/GHSA-qccp-gfcp-xxvc","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://nvd.nist.gov/vuln/detail/CVE-2026-44431"],"description":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44431","epss":0.00331,"percentile":0.26333,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44431","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.7.0"],"state":"fixed","available":[{"version":"2.7.0","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.23583750000000003},"relatedVulnerabilities":[{"id":"CVE-2026-44431","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html"],"description":"urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44431","epss":0.00331,"percentile":0.26333,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44431","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-qccp-gfcp-xxvc","versionConstraint":">=1.23,<2.7.0 (python)"},"fix":{"suggestedVersion":"2.7.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.1.0?package-id=960fd57f59138971","name":"urllib3","version":"2.1.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-65pc-fj4g-8rjx","dataSource":"https://github.com/advisories/GHSA-65pc-fj4g-8rjx","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx","https://nvd.nist.gov/vuln/detail/CVE-2026-45409","https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"],"description":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45409","epss":0.00408,"percentile":0.351,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45409","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15"],"state":"fixed","available":[{"version":"3.15","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.22643999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-45409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"],"description":"Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45409","epss":0.00408,"percentile":0.351,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45409","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"idna","version":"3.7"}},"found":{"vulnerabilityID":"GHSA-65pc-fj4g-8rjx","versionConstraint":"<3.15 (python)"},"fix":{"suggestedVersion":"3.15"}}],"artifact":{"id":"pkg:pypi/idna@3.7?package-id=277361fcaf5ece55","name":"idna","version":"3.7","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:kjd:internationalized_domain_names_in_applications:3.7:*:*:*:*:python:*:*"],"purl":"pkg:pypi/idna@3.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-c978-59m8-c77v","dataSource":"https://github.com/advisories/GHSA-c978-59m8-c77v","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-c978-59m8-c77v","https://nvd.nist.gov/vuln/detail/CVE-2026-113722","https://github.com/pypa/virtualenv/pull/3417","https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113722","epss":0.00285,"percentile":0.21102,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113722","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.21802500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-113722","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113722","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9","https://github.com/pypa/virtualenv/pull/3417","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-c978-59m8-c77v"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user's privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113722","epss":0.00285,"percentile":0.21102,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113722","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-c978-59m8-c77v","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxj4-q4g9-crj7","dataSource":"https://github.com/advisories/GHSA-vxj4-q4g9-crj7","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7","https://nvd.nist.gov/vuln/detail/CVE-2026-113725","https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932","https://github.com/pypa/virtualenv/releases/tag/21.14.7"],"description":"virtualenv bash activate runs commands from an environment name with a backslash before $","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113725","epss":0.00263,"percentile":0.18246,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113725","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-113725","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.7"],"state":"fixed","available":[{"version":"21.14.7","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.201195},"relatedVulnerabilities":[{"id":"CVE-2026-113725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113725","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932","https://github.com/pypa/virtualenv/releases/tag/21.14.7","https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \\$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113725","epss":0.00263,"percentile":0.18246,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113725","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-113725","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-vxj4-q4g9-crj7","versionConstraint":"<=21.14.6 (python)"},"fix":{"suggestedVersion":"21.14.7"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c947-3pg5-gm8q","dataSource":"https://github.com/advisories/GHSA-c947-3pg5-gm8q","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q","https://nvd.nist.gov/vuln/detail/CVE-2026-113732","https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab","https://github.com/pypa/virtualenv/releases/tag/21.14.2"],"description":"virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113732","epss":0.00236,"percentile":0.14711,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113732","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-113732","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.2"],"state":"fixed","available":[{"version":"21.14.2","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.18054},"relatedVulnerabilities":[{"id":"CVE-2026-113732","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113732","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab","https://github.com/pypa/virtualenv/releases/tag/21.14.2","https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113732","epss":0.00236,"percentile":0.14711,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113732","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-113732","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-c947-3pg5-gm8q","versionConstraint":"<=21.14.1 (python)"},"fix":{"suggestedVersion":"21.14.2"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-9wx4-h78v-vm56","dataSource":"https://github.com/advisories/GHSA-9wx4-h78v-vm56","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56","https://github.com/psf/requests/pull/6655","https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac","https://nvd.nist.gov/vuln/detail/CVE-2024-35195","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ"],"description":"Requests `Session` object does not verify requests after making first request with verify=False","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.6,"exploitabilityScore":0.4,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-35195","epss":0.0034,"percentile":0.27511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-35195","cwe":"CWE-670","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.32.0"],"state":"fixed","available":[{"version":"2.32.0","date":"2024-05-21","kind":"first-observed"}]},"advisories":[],"risk":0.1802},"relatedVulnerabilities":[{"id":"CVE-2024-35195","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac","https://github.com/psf/requests/pull/6655","https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/"],"description":"Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.6,"exploitabilityScore":0.4,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-35195","epss":0.0034,"percentile":0.27511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-35195","cwe":"CWE-670","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"requests","version":"2.31.0"}},"found":{"vulnerabilityID":"GHSA-9wx4-h78v-vm56","versionConstraint":"<2.32.0 (python)"},"fix":{"suggestedVersion":"2.32.0"}}],"artifact":{"id":"pkg:pypi/requests@2.31.0?package-id=b6832aab2298525d","name":"requests","version":"2.31.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:requests:2.31.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/requests@2.31.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-394h-qwmc-48pf","dataSource":"https://github.com/advisories/GHSA-394h-qwmc-48pf","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf","https://nvd.nist.gov/vuln/detail/CVE-2026-113718","https://github.com/pypa/virtualenv/pull/3432","https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Xonsh activation literals depend on the script decoding codec","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113718","epss":0.00242,"percentile":0.15464,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113718","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.17665999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-113718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113718","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0","https://github.com/pypa/virtualenv/pull/3432","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113718","epss":0.00242,"percentile":0.15464,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113718","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-394h-qwmc-48pf","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6w3r-xr62-4xcp","dataSource":"https://github.com/advisories/GHSA-6w3r-xr62-4xcp","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp","https://nvd.nist.gov/vuln/detail/CVE-2026-113723","https://github.com/pypa/virtualenv/pull/3418","https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Bash prompt values can change meaning under older compatibility modes","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113723","epss":0.00242,"percentile":0.15464,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113723","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.17665999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-113723","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113723","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22","https://github.com/pypa/virtualenv/pull/3418","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113723","epss":0.00242,"percentile":0.15464,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113723","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-6w3r-xr62-4xcp","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8988-9cw3-xx77","dataSource":"https://github.com/advisories/GHSA-8988-9cw3-xx77","namespace":"github:language:python","severity":"High","urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"description":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.8.0"],"state":"fixed","available":[{"version":"2.8.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.15553},"relatedVulnerabilities":[{"id":"CVE-2026-97687","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97687","epss":0.00206,"percentile":0.10662,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-97687","cwe":"CWE-440","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"urllib3","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-8988-9cw3-xx77","versionConstraint":">=1.26.0,<2.8.0 (python)"},"fix":{"suggestedVersion":"2.8.0"}}],"artifact":{"id":"pkg:pypi/urllib3@2.1.0?package-id=960fd57f59138971","name":"urllib3","version":"2.1.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:urllib3:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/urllib3@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-x78j-v8h9-3j2q","dataSource":"https://github.com/advisories/GHSA-x78j-v8h9-3j2q","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q","https://nvd.nist.gov/vuln/detail/CVE-2026-102937","https://github.com/pypa/virtualenv/pull/3250","https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6","https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4014.yaml","https://github.com/pypa/virtualenv","https://github.com/pypa/virtualenv/releases/tag/21.7.12","https://pypi.org/project/virtualenv"],"description":"virtualenv: Command injection via --prompt in activate.bat (batch activator)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102937","epss":0.00208,"percentile":0.10923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102937","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.7.12"],"state":"fixed","available":[{"version":"21.7.12","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.15392},"relatedVulnerabilities":[{"id":"CVE-2026-102937","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102937","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6","https://github.com/pypa/virtualenv/pull/3250","https://github.com/pypa/virtualenv/releases/tag/21.7.12","https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set \"VAR=value\" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102937","epss":0.00208,"percentile":0.10923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102937","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-x78j-v8h9-3j2q","versionConstraint":"<=21.7.11 (python)"},"fix":{"suggestedVersion":"21.7.12"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-94p9-xgh2-xp45","dataSource":"https://github.com/advisories/GHSA-94p9-xgh2-xp45","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45","https://nvd.nist.gov/vuln/detail/CVE-2026-102930","https://github.com/pypa/virtualenv/pull/3251","https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d","https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4011.yaml","https://github.com/pypa/virtualenv","https://github.com/pypa/virtualenv/releases/tag/21.7.12","https://pypi.org/project/virtualenv"],"description":"virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102930","epss":0.00197,"percentile":0.09413,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102930","cwe":"CWE-494","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.7.12"],"state":"fixed","available":[{"version":"21.7.12","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.14972},"relatedVulnerabilities":[{"id":"CVE-2026-102930","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102930","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d","https://github.com/pypa/virtualenv/pull/3251","https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102930","epss":0.00197,"percentile":0.09413,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102930","cwe":"CWE-494","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-94p9-xgh2-xp45","versionConstraint":"<=21.7.11 (python)"},"fix":{"suggestedVersion":"21.7.12"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-jfmj-5v4g-7637","dataSource":"https://github.com/advisories/GHSA-jfmj-5v4g-7637","namespace":"github:language:python","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-5569","https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd","https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae"],"description":"zipp Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-5569","epss":0.00236,"percentile":0.14617,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-5569","cwe":"CWE-835","source":"security@huntr.dev","type":"Secondary"}],"fix":{"versions":["3.19.1"],"state":"fixed","available":[{"version":"3.19.1","date":"2024-07-10","kind":"first-observed"}]},"advisories":[],"risk":0.13629},"relatedVulnerabilities":[{"id":"CVE-2024-5569","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5569","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd","https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae"],"description":"A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.","cvss":[{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-5569","epss":0.00236,"percentile":0.14617,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-5569","cwe":"CWE-835","source":"security@huntr.dev","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"zipp","version":"3.18.1"}},"found":{"vulnerabilityID":"GHSA-jfmj-5v4g-7637","versionConstraint":"<3.19.1 (python)"},"fix":{"suggestedVersion":"3.19.1"}}],"artifact":{"id":"pkg:pypi/zipp@3.18.1?package-id=949231e81b3f742a","name":"zipp","version":"3.18.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-zipp:python-zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:python-zipp:python_zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:python_zipp:python-zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:python_zipp:python_zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:python-zipp:zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:python_zipp:zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:zipp:python-zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:zipp:python_zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:python:zipp:3.18.1:*:*:*:*:*:*:*","cpe:2.3:a:zipp:zipp:3.18.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/zipp@3.18.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-69hj-f68j-2879","dataSource":"https://github.com/advisories/GHSA-69hj-f68j-2879","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879","https://nvd.nist.gov/vuln/detail/CVE-2026-112909","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.12209999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112909","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879"],"description":"filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-69hj-f68j-2879","versionConstraint":"<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.13.1?package-id=ec6923b0c4c46bee","name":"filelock","version":"3.13.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.13.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-p58f-9548-mpm2","dataSource":"https://github.com/advisories/GHSA-p58f-9548-mpm2","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2","https://nvd.nist.gov/vuln/detail/CVE-2026-102925","https://github.com/pypa/virtualenv/pull/3252","https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6","https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4013.yaml","https://github.com/pypa/virtualenv","https://github.com/pypa/virtualenv/releases/tag/21.7.13","https://pypi.org/project/virtualenv"],"description":"virtualenv bash and fish activation scripts execute commands embedded in paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102925","epss":0.00159,"percentile":0.0498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102925","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.7.13"],"state":"fixed","available":[{"version":"21.7.13","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.12163500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-102925","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102925","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6","https://github.com/pypa/virtualenv/pull/3252","https://github.com/pypa/virtualenv/releases/tag/21.7.13","https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102925","epss":0.00159,"percentile":0.0498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102925","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-p58f-9548-mpm2","versionConstraint":"<=21.7.12 (python)"},"fix":{"suggestedVersion":"21.7.13"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w853-jp5j-5j7f","dataSource":"https://github.com/advisories/GHSA-w853-jp5j-5j7f","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f","https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e","https://github.com/tox-dev/filelock/releases/tag/3.20.1","https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants","https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html"],"description":"filelock has a TOCTOU race condition which allows symlink attacks during lock file creation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"exploitabilityScore":1.1,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68146","epss":0.00198,"percentile":0.09546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-68146","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-68146","cwe":"CWE-362","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-68146","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-68146","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.20.1"],"state":"fixed","available":[{"version":"3.20.1","date":"2025-12-17","kind":"first-observed"}]},"advisories":[],"risk":0.11186999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-68146","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68146","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e","https://github.com/tox-dev/filelock/pull/461","https://github.com/tox-dev/filelock/releases/tag/3.20.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f"],"description":"filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. All users of filelock on Unix, Linux, macOS, and Windows systems are impacted. The vulnerability cascades to dependent libraries. The attack requires local filesystem access and ability to create symlinks (standard user permissions on Unix; Developer Mode on Windows 10+). Exploitation succeeds within 1-3 attempts when lock file paths are predictable. The issue is fixed in version 3.20.1. If immediate upgrade is not possible, use SoftFileLock instead of UnixFileLock/WindowsFileLock (note: different locking semantics, may not be suitable for all use cases); ensure lock file directories have restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks; and/or monitor lock file directories for suspicious symlinks before running trusted applications. These workarounds provide only partial mitigation. The race condition remains exploitable. Upgrading to version 3.20.1 is strongly recommended.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":1.1,"impactScore":5.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"exploitabilityScore":1.1,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68146","epss":0.00198,"percentile":0.09546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-68146","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-68146","cwe":"CWE-362","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-68146","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-68146","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-w853-jp5j-5j7f","versionConstraint":"<3.20.1 (python)"},"fix":{"suggestedVersion":"3.20.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.13.1?package-id=ec6923b0c4c46bee","name":"filelock","version":"3.13.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.13.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-43mp-35q3-x3fq","dataSource":"https://github.com/advisories/GHSA-43mp-35q3-x3fq","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq","https://nvd.nist.gov/vuln/detail/CVE-2026-113724","https://github.com/pypa/virtualenv/pull/3427","https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Deletion recovery can change a symlink target's mode","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113724","epss":0.00203,"percentile":0.10344,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113724","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.09642500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-113724","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113724","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440","https://github.com/pypa/virtualenv/pull/3427","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can therefore cause a victim-owned target outside the destination that is initially not writable by the invoking user to become broadly writable before the retry fails, provided that user owns the target and can change its mode. Another account can use the widened mode only if it can traverse the target's parent directories; root does not reach the demonstrated failure path, and the operation does not itself read the target. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113724","epss":0.00203,"percentile":0.10344,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113724","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-43mp-35q3-x3fq","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-hhxq-47xx-j5xx","dataSource":"https://github.com/advisories/GHSA-hhxq-47xx-j5xx","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx","https://nvd.nist.gov/vuln/detail/CVE-2026-113719","https://github.com/pypa/virtualenv/pull/3428","https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Seed replacement does not contain metadata deletion paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113719","epss":0.00203,"percentile":0.10344,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113719","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.09642500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-113719","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113719","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f","https://github.com/pypa/virtualenv/pull/3428","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113719","epss":0.00203,"percentile":0.10344,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113719","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-hhxq-47xx-j5xx","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6w46-j5rx-g56g","dataSource":"https://github.com/advisories/GHSA-6w46-j5rx-g56g","namespace":"github:language:python","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-71176","https://github.com/pytest-dev/pytest/issues/13669","https://www.openwall.com/lists/oss-security/2026/01/21/5","https://github.com/pytest-dev/pytest/pull/14343","https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c","https://github.com/pytest-dev/pytest/releases/tag/9.0.3"],"description":"pytest has vulnerable tmpdir handling","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.8,"exploitabilityScore":2.6,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-71176","epss":0.00154,"percentile":0.04474,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-71176","cwe":"CWE-379","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":["9.0.3"],"state":"fixed","available":[{"version":"9.0.3","date":"2026-04-14","kind":"first-observed"}]},"advisories":[],"risk":0.09085999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-71176","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-71176","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pytest-dev/pytest/issues/13669","https://www.openwall.com/lists/oss-security/2026/01/21/5"],"description":"pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.8,"exploitabilityScore":2.6,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-71176","epss":0.00154,"percentile":0.04474,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-71176","cwe":"CWE-379","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pytest","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-6w46-j5rx-g56g","versionConstraint":"<9.0.3 (python)"},"fix":{"suggestedVersion":"9.0.3"}}],"artifact":{"id":"pkg:pypi/pytest@7.4.3?package-id=056d794b7677a818","name":"pytest","version":"7.4.3","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pytest:python-pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:python-pytest:python_pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:python_pytest:python-pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:python_pytest:python_pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:pytest:python-pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:pytest:python_pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:python-pytest:pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:python_pytest:pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:pytest:pytest:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:python:pytest:7.4.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pytest@7.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-gc5v-m9x4-r6x2","dataSource":"https://github.com/advisories/GHSA-gc5v-m9x4-r6x2","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2","https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7","https://github.com/psf/requests/releases/tag/v2.33.0","https://nvd.nist.gov/vuln/detail/CVE-2026-25645"],"description":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25645","epss":0.00189,"percentile":0.0861,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25645","cwe":"CWE-377","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.33.0"],"state":"fixed","available":[{"version":"2.33.0","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.08883},"relatedVulnerabilities":[{"id":"CVE-2026-25645","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7","https://github.com/psf/requests/releases/tag/v2.33.0","https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"],"description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25645","epss":0.00189,"percentile":0.0861,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25645","cwe":"CWE-377","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"requests","version":"2.31.0"}},"found":{"vulnerabilityID":"GHSA-gc5v-m9x4-r6x2","versionConstraint":"<2.33.0 (python)"},"fix":{"suggestedVersion":"2.33.0"}}],"artifact":{"id":"pkg:pypi/requests@2.31.0?package-id=b6832aab2298525d","name":"requests","version":"2.31.0","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:requests:2.31.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/requests@2.31.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9h9j-4vrj-gf7g","dataSource":"https://github.com/advisories/GHSA-9h9j-4vrj-gf7g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g","https://nvd.nist.gov/vuln/detail/CVE-2026-102938","https://github.com/pypa/virtualenv/pull/3247","https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140","https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml","https://github.com/pypa/virtualenv/releases/tag/21.7.11","https://pypi.org/project/virtualenv"],"description":"virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102938","epss":0.00146,"percentile":0.03843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102938","cwe":"CWE-93","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.7.11"],"state":"fixed","available":[{"version":"21.7.11","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.07884},"relatedVulnerabilities":[{"id":"CVE-2026-102938","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102938","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140","https://github.com/pypa/virtualenv/pull/3247","https://github.com/pypa/virtualenv/releases/tag/21.7.11","https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102938","epss":0.00146,"percentile":0.03843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102938","cwe":"CWE-93","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-9h9j-4vrj-gf7g","versionConstraint":"<=21.7.10 (python)"},"fix":{"suggestedVersion":"21.7.11"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-cx28-75q4-x26q","dataSource":"https://github.com/advisories/GHSA-cx28-75q4-x26q","namespace":"github:language:python","severity":"Low","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q","https://nvd.nist.gov/vuln/detail/CVE-2026-113717","https://github.com/pypa/virtualenv/pull/3430","https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Pip seeding with download omits wheel digest verification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113717","epss":0.00293,"percentile":0.21917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113717","cwe":"CWE-494","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.077645},"relatedVulnerabilities":[{"id":"CVE-2026-113717","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113717","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96","https://github.com/pypa/virtualenv/pull/3430","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113717","epss":0.00293,"percentile":0.21917,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113717","cwe":"CWE-494","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-cx28-75q4-x26q","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-558c-9hv2-4prj","dataSource":"https://github.com/advisories/GHSA-558c-9hv2-4prj","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj","https://nvd.nist.gov/vuln/detail/CVE-2026-113721","https://github.com/pypa/virtualenv/pull/3431","https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Generated files can follow existing destination links","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113721","epss":0.00144,"percentile":0.0366,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113721","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.0684},"relatedVulnerabilities":[{"id":"CVE-2026-113721","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113721","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd","https://github.com/pypa/virtualenv/pull/3431","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account that prepares final entries inside the destination can therefore cause environment creation to create or overwrite files outside the requested tree with constrained virtualenv-generated content and the invoking user's permissions. The destination parent must remain controlled by the environment owner during creation; concurrent parent-directory replacement is a separate concern. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113721","epss":0.00144,"percentile":0.0366,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113721","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-558c-9hv2-4prj","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-cw65-gx24-rc82","dataSource":"https://github.com/advisories/GHSA-cw65-gx24-rc82","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-cw65-gx24-rc82","https://nvd.nist.gov/vuln/detail/CVE-2026-113716","https://github.com/pypa/virtualenv/pull/3429","https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Builtin creation follows linked environment directories","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113716","epss":0.00144,"percentile":0.0366,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113716","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.0684},"relatedVulnerabilities":[{"id":"CVE-2026-113716","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113716","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5","https://github.com/pypa/virtualenv/pull/3429","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-cw65-gx24-rc82"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination when another local account prepared the tree and the invoking user can access the target. The --clear option removes the planted tree first, while ordinary creation reaches it; arbitrary attacker-selected output bytes are not established. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113716","epss":0.00144,"percentile":0.0366,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113716","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-cw65-gx24-rc82","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-494p-63j8-28p3","dataSource":"https://github.com/advisories/GHSA-494p-63j8-28p3","namespace":"github:language:python","severity":"Low","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3","https://nvd.nist.gov/vuln/detail/CVE-2026-113714","https://github.com/pypa/virtualenv/pull/3430","https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Downloaded wheel selection and caching precede verification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113714","epss":0.00249,"percentile":0.16332,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113714","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.065985},"relatedVulnerabilities":[{"id":"CVE-2026-113714","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113714","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96","https://github.com/pypa/virtualenv/pull/3430","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without verification. A separate rejected-cache-file variant requires control over downloaded data or archive selection but not the forged-line prerequisites. Explicit custom-index exceptions are outside the promised PyPI comparison, and the issue does not independently bypass TLS or establish control of default PyPI. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113714","epss":0.00249,"percentile":0.16332,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113714","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-494p-63j8-28p3","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qmgc-5h2g-mvrw","dataSource":"https://github.com/advisories/GHSA-qmgc-5h2g-mvrw","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw","https://nvd.nist.gov/vuln/detail/CVE-2026-22701","https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0","https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5"],"description":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.1,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22701","epss":0.00127,"percentile":0.02309,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22701","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-22701","cwe":"CWE-362","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-22701","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.20.3"],"state":"fixed","available":[{"version":"3.20.3","date":"2026-01-14","kind":"first-observed"}]},"advisories":[],"risk":0.065405},"relatedVulnerabilities":[{"id":"CVE-2026-22701","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22701","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0","https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5","https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw"],"description":"filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.1,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22701","epss":0.00127,"percentile":0.02309,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22701","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-22701","cwe":"CWE-362","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-22701","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-qmgc-5h2g-mvrw","versionConstraint":"<3.20.3 (python)"},"fix":{"suggestedVersion":"3.20.3"}}],"artifact":{"id":"pkg:pypi/filelock@3.13.1?package-id=ec6923b0c4c46bee","name":"filelock","version":"3.13.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.13.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-fc2g-4w5p-6whm","dataSource":"https://github.com/advisories/GHSA-fc2g-4w5p-6whm","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm","https://nvd.nist.gov/vuln/detail/CVE-2026-113720","https://github.com/pypa/virtualenv/pull/3425","https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Seeded files retain permissions from an older cache","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":4.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113720","epss":0.00134,"percentile":0.02854,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113720","cwe":"CWE-732","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.06298000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-113720","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113720","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1","https://github.com/pypa/virtualenv/pull/3425","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113720","epss":0.00134,"percentile":0.02854,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113720","cwe":"CWE-732","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-fc2g-4w5p-6whm","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-qmx5-4p3x-wvqf","dataSource":"https://github.com/advisories/GHSA-qmx5-4p3x-wvqf","namespace":"github:language:python","severity":"Low","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf","https://nvd.nist.gov/vuln/detail/CVE-2026-113715","https://github.com/pypa/virtualenv/pull/3426","https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a","https://github.com/pypa/virtualenv/releases/tag/21.14.9"],"description":"virtualenv: Venv configuration readback can reinterpret path boundaries","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113715","epss":0.00242,"percentile":0.15464,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113715","cwe":"CWE-93","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.9"],"state":"fixed","available":[{"version":"21.14.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.0605},"relatedVulnerabilities":[{"id":"CVE-2026-113715","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113715","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a","https://github.com/pypa/virtualenv/pull/3426","https://github.com/pypa/virtualenv/releases/tag/21.14.9","https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113715","epss":0.00242,"percentile":0.15464,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113715","cwe":"CWE-93","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-qmx5-4p3x-wvqf","versionConstraint":"<21.14.9 (python)"},"fix":{"suggestedVersion":"21.14.9"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-597g-3phw-6986","dataSource":"https://github.com/advisories/GHSA-597g-3phw-6986","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986","https://nvd.nist.gov/vuln/detail/CVE-2026-22702","https://github.com/pypa/virtualenv/pull/3013","https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc"],"description":"virtualenv Has TOCTOU Vulnerabilities in Directory Creation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22702","epss":0.001,"percentile":0.0086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22702","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-22702","cwe":"CWE-362","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["20.36.1"],"state":"fixed","available":[{"version":"20.36.1","date":"2026-01-14","kind":"first-observed"}]},"advisories":[],"risk":0.0475},"relatedVulnerabilities":[{"id":"CVE-2026-22702","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22702","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc","https://github.com/pypa/virtualenv/pull/3013","https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986"],"description":"virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.5,"exploitabilityScore":1.1,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22702","epss":0.001,"percentile":0.0086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-22702","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-22702","cwe":"CWE-362","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"20.26.1"}},"found":{"vulnerabilityID":"GHSA-597g-3phw-6986","versionConstraint":"<20.36.1 (python)"},"fix":{"suggestedVersion":"20.36.1"}}],"artifact":{"id":"pkg:pypi/virtualenv@20.26.1?package-id=4fb3cf4b2c968fe3","name":"virtualenv","version":"20.26.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:20.26.1:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:20.26.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@20.26.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6q48-6c7w-9gw2","dataSource":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2","namespace":"github:language:python","severity":"Critical","urls":["https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2","https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576","https://emudhra.we-have-a-problem.com"],"description":"certifi bundles emSign root CAs with compromised intermediate CA keys","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.1},"vendorMetadata":{}}],"fix":{"versions":["2026.10.18"],"state":"fixed","available":[{"version":"2026.10.18","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"certifi","version":"2023.11.17"}},"found":{"vulnerabilityID":"GHSA-6q48-6c7w-9gw2","versionConstraint":">=2019.03.09,<2026.10.18 (python)"},"fix":{"suggestedVersion":"2026.10.18"}}],"artifact":{"id":"pkg:pypi/certifi@2023.11.17?package-id=1834cb1629eb62ba","name":"certifi","version":"2023.11.17","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:certifi:certifi:2023.11.17:*:*:*:*:python:*:*"],"purl":"pkg:pypi/certifi@2023.11.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-5xjx-3w67-w9x9","dataSource":"https://github.com/advisories/GHSA-5xjx-3w67-w9x9","namespace":"github:language:github-action","severity":"Critical","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9"],"description":"pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"fix":{"versions":["1.14.3"],"state":"fixed","available":[{"version":"1.14.3","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"v1.5.0"}},"found":{"vulnerabilityID":"GHSA-5xjx-3w67-w9x9","versionConstraint":"<=1.14.2 (unknown)"},"fix":{"suggestedVersion":"1.14.3"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@v1.5.0?package-id=b9851ccbc1129d9c","name":"pypa/gh-action-pypi-publish","version":"v1.5.0","type":"github-action","locations":[{"path":"/.github/workflows/pypi.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@v1.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8mx5-7m5m-r77g","dataSource":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112910","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-8mx5-7m5m-r77g","versionConstraint":">=3.10.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.13.1?package-id=ec6923b0c4c46bee","name":"filelock","version":"3.13.1","type":"python","locations":[{"path":"/requirements-dev.txt","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.13.1:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.13.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-vxmw-7h4f-hqxh","dataSource":"https://github.com/advisories/GHSA-vxmw-7h4f-hqxh","namespace":"github:language:github-action","severity":"Low","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-vxmw-7h4f-hqxh","https://github.com/pypa/gh-action-pypi-publish/commit/77db1b7cf7dcea2e403bb4350516284282740dd6"],"description":"PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","metrics":{"baseScore":0,"exploitabilityScore":3.9,"impactScore":0},"vendorMetadata":{}}],"fix":{"versions":["1.13.0"],"state":"fixed","available":[{"version":"1.13.0","date":"2025-09-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"v1.5.0"}},"found":{"vulnerabilityID":"GHSA-vxmw-7h4f-hqxh","versionConstraint":"<1.13.0 (unknown)"},"fix":{"suggestedVersion":"1.13.0"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@v1.5.0?package-id=b9851ccbc1129d9c","name":"pypa/gh-action-pypi-publish","version":"v1.5.0","type":"github-action","locations":[{"path":"/.github/workflows/pypi.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:v1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:v1.5.0:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@v1.5.0","upstreams":[]}}],"source":{"type":"file","target":"Yelp/detect-secrets"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:09:55.074393187Z"}}