Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
python-pip can execute unwanted commands when activating virtualenv
published 1 month ago
Summary
The python-pip package used to create isolated Python environments on Windows can be tricked into running extra commands when a user activates the environment. An attacker who can set the prompt text could inject commands that run with the user’s rights. Update python-pip to version 21.7.12 or later to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | python-pip | <= 24.2-10 |
Original advisory text
CVE-2026-102937 affecting package python-pip 24.2-10
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.
References
Timeline
Published29 Sep 2026
Updated3 Oct 2026
First seen3 Oct 2026
Sources
AZL-105648 · OSV
Track software like this
Free during beta