Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
azure/python-virtualenv may load untrusted code during install
published 6 months ago
Summary
When pip versions older than 26.1 install a package, it runs a self‑update check after the package’s files are placed. This can cause newly added Python modules to be imported immediately, potentially executing malicious code. Upgrade pip to version 26.1 or later and always review package contents before installing.
What to do
- Update azure python-virtualenv to version 20.36.1-4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | python-virtualenv |
< 20.36.1-4 Fix: upgrade to 20.36.1-4
|
Original advisory text
CVE-2026-6357 affecting package python-virtualenv for versions less than 20.36.1-4
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
References
Timeline
Published27 Apr 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-85265 · OSV
Track software like this
Free during beta