Skip to content

Update dependency virtualenv to v20.36.1 [SECURITY] - #256

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-virtualenv-vulnerability
Open

Update dependency virtualenv to v20.36.1 [SECURITY]#256
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-virtualenv-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
virtualenv (changelog) ==20.15.1 → ==20.36.1 age confidence

virtualenv allows command injection through activation scripts for a virtual environment

CVE-2024-53899 / GHSA-rqc4-2hc7-8c8v

More information

Details

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Severity

  • CVSS Score: 8.4 / 10 (High)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

CVE-2026-22702 / GHSA-597g-3phw-6986

More information

Details

Impact

TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations.

Affected versions: All versions up to and including 20.36.1

Affected users: Any user running virtualenv on multi-user systems where untrusted local users have filesystem access to shared temporary directories or where VIRTUALENV_OVERRIDE_APP_DATA points to a user-writable location.

Attack scenarios:

  • Cache poisoning: Attacker corrupts wheels or Python metadata in the cache
  • Information disclosure: Attacker reads sensitive cached data or metadata
  • Lock bypass: Attacker controls lock file semantics to cause concurrent access violations
  • Denial of service: Lock starvation preventing virtualenv operations
Patches

The vulnerability has been patched by replacing check-then-act patterns with atomic os.makedirs(..., exist_ok=True) operations.

Fixed in: PR #​3013

Versions with the fix: 20.36.2 and later

Users should upgrade to version 20.36.2 or later.

Workarounds

If you cannot upgrade immediately:

  1. Ensure VIRTUALENV_OVERRIDE_APP_DATA points to a directory owned by the current user with restricted permissions (mode 0700)
  2. Avoid running virtualenv in shared temporary directories where other users have write access
  3. Use separate user accounts for different projects to isolate app_data directories
References
  • GitHub PR: https://github.com/pypa/virtualenv/pull/3013
  • Vulnerability reported by: @​tsigouris007
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (TOCTOU)
  • CWE-59: Improper Link Resolution Before File Access

Severity

  • CVSS Score: 4.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

pypa/virtualenv (virtualenv)

v20.36.1

Compare Source

Bugfixes - 20.36.1

  • Fix TOCTOU vulnerabilities in app_data and lock directory creation that could be exploited via symlink attacks -
    reported by tsigouris007, fixed by gaborbernat. (#​3013)

PyPI release

Full Changelog: pypa/virtualenv@20.36.0...20.36.1

v20.36.0

Compare Source

Features - 20.36.0

  • Add support for PEP 440 version specifiers in the --python flag. Users can now specify Python versions using
    operators like >=, <=, ~=, etc. For example: virtualenv --python=">=3.12" myenv `. (#​2994)

PyPI release

Full Changelog: pypa/virtualenv@20.35.4...20.36.0

v20.35.4

Compare Source

Bugfixes - 20.35.4

  • Fix race condition in _virtualenv.py when file is overwritten during import, preventing NameError when
    _DISTUTILS_PATCH is accessed - by gracetyy. (#​2969)

  • Upgrade embedded wheels:

PyPI release

Full Changelog: pypa/virtualenv@20.35.3...20.35.4

v20.35.3

Compare Source

Bugfixes - 20.35.3

  • Accept RuntimeError in test_too_many_open_files, by esafak (#​2935)

PyPI release

Full Changelog: pypa/virtualenv@20.35.2...20.35.3

v20.35.2

Compare Source

Bugfixes - 20.35.2

  • Revert out changes related to the extraction of the discovery module - by gaborbernat. (#​2978)

PyPI release

Full Changelog: pypa/virtualenv@20.35.1...20.35.2

v20.35.1

Compare Source

Bugfixes - 20.35.1

  • Patch get_interpreter to handle missing cache and app_data - by esafak (#​2972)
  • Fix backwards incompatible changes to PythonInfo - by gaborbernat. (#​2975)

PyPI release

Full Changelog: pypa/virtualenv@20.35.0...20.35.1

v20.35.0

Compare Source

Features - 20.35.0

  • Add AppData and Cache protocols to discovery for decoupling - by esafak. (#​2074)
  • Ensure python3.exe and python3 on Windows for Python 3 - by esafak. (#​2774)

Bugfixes - 20.35.0

  • Replaced direct references to tcl/tk library paths with getattr - by esafak (#​2944)
  • Restore absolute import of fs_is_case_sensitive - by esafak. (#​2955)

PyPI release

Full Changelog: pypa/virtualenv@20.34.0...20.35.0

v20.34.0

Compare Source

Features - 20.34.0

  • Abstract out caching in discovery - by esafak. Decouple FileCache from py_info (discovery) - by
    esafak. Remove references to py_info in FileCache - by esafak. Decouple discovery from creator plugins
    • by esafak. Decouple discovery by duplicating info utils - by esafak. (#​2074)
  • Add PyPy 3.11 support. Contributed by esafak. (#​2932)

Bugfixes - 20.34.0

  • Upgrade embedded wheel pip to 25.2 from 25.1.1 - by gaborbernat. (#​2333)
  • Accept RuntimeError in test_too_many_open_files, by esafak (#​2935)
  • Python in PATH takes precedence over uv-managed python. Contributed by edgarrmondragon. (#​2952)

PyPI release

Full Changelog: pypa/virtualenv@20.33.1...20.34.0

v20.33.1

Compare Source

Bugfixes - 20.33.1

  • Correctly unpack _get_tcl_tk_libs() response in PythonInfo. Contributed by esafak. (#​2930)
  • Restore py_info.py timestamp in test_py_info_cache_invalidation_on_py_info_change Contributed by esafak.
    (#​2933)

PyPI release

Full Changelog: pypa/virtualenv@20.33.0...20.33.1

v20.33.0

Compare Source

Features - 20.33.0

  • Added support for Tcl and Tkinter. You're welcome. Contributed by esafak. (#​425)

Bugfixes - 20.33.0

  • Prevent logging setup when --help is passed, fixing a flaky test. Contributed by esafak. (u)
  • Fix cache invalidation for PythonInfo by hashing py_info.py. Contributed by esafak. (#​2467)
  • When no discovery plugins are found, the application would crash with a StopIteration. This change catches the
    StopIteration and raises a RuntimeError with a more informative message. Contributed by esafak.
    (#​2493)
  • Stop --try-first-with overriding absolute --python paths. Contributed by esafak. (#​2659)
  • Force UTF-8 encoding for pip download Contributed by esafak. (#​2780)
  • Creating a virtual environment on a filesystem without symlink-support would fail even with --copies Make
    fs_supports_symlink perform a real symlink creation check on all platforms. Contributed by esafak.
    (#​2786)
  • Add a note to the user guide recommending the use of a specific Python version when creating virtual environments.
    Contributed by esafak. (#​2808)
  • Fix 'Too many open files' error due to a file descriptor leak in virtualenv's locking mechanism. Contributed by
    esafak. (#​2834)
  • Support renamed Windows venv redirector (venvlauncher.exe and venvwlauncher.exe) on Python 3.13 Contributed by
    esafak. (#​2851)
  • Resolve Nushell activation script deprecation warnings by dynamically selecting the --optional flag for Nushell
    get command on version 0.106.0 and newer, while retaining the deprecated -i flag for older versions to
    maintain compatibility. Contributed by gaborbernat. (#​2910)

PyPI release

Full Changelog: pypa/virtualenv@20.32.0...20.33.0

v20.32.0

Compare Source

Features - 20.32.0

  • Warn on incorrect invocation of Nushell activation script - by esafak. (nushell_activation)
  • Discover uv-managed Python installations (#​2901)

Bugfixes - 20.32.0

  • Ignore missing absolute paths for python discovery - by esafak (#​2870)
  • Upgrade embedded setuptools to 80.9.0 from 80.3.1 - by gaborbernat. (#​2900)

PyPI release

Full Changelog: pypa/virtualenv@20.31.2...20.32.0

v20.31.2

Compare Source

No significant changes.

PyPI release

Full Changelog: pypa/virtualenv@20.31.1...20.31.2

v20.31.1

Compare Source

Bugfixes - 20.31.1

  • Upgrade embedded wheels:

    • pip to 25.1.1 from 25.1
    • setuptools to 80.3.1 from 78.1.0 (#​2880)

PyPI release

Full Changelog: pypa/virtualenv@20.31.0...20.31.1

v20.31.0

Compare Source

Features - 20.31.0

  • No longer bundle wheel wheels (except on Python 3.8), setuptools includes native bdist_wheel support.
    Update pip to 25.1. (#​2868)

Bugfixes - 20.31.0

  • get_embed_wheel() no longer fails with a TypeError when it is called with an unknown distribution.
    (#​2877)
  • Fix HelpFormatter error with Python 3.14.0b1. (#​2878)

PyPI release

Full Changelog: pypa/virtualenv@20.30.0...20.31.0

v20.30.0

Compare Source

Features - 20.30.0

  • Add support for GraalPy <https://github.com/oracle/graalpython>_. (#​2832)

Bugfixes - 20.30.0

  • Upgrade embedded wheels:

    • setuptools to 78.1.0 from 75.3.2 (#​2863)

PyPI release

Full Changelog: pypa/virtualenv@20.29.3...20.30.0

v20.29.3

Compare Source

Bugfixes - 20.29.3

  • Ignore unreadable directories in PATH. (#​2794)

PyPI release

Full Changelog: pypa/virtualenv@20.29.2...20.29.3

v20.29.2

Compare Source

Bugfixes - 20.29.2

  • Remove old virtualenv wheel from the source distribution - by gaborbernat. (#​2841)
  • Upgrade embedded wheel pip to 25.0.1 from 24.3.1 - by gaborbernat. (#​2843)

PyPI release

Full Changelog: pypa/virtualenv@20.29.1...20.29.2

v20.29.1

Compare Source

Bugfixes - 20.29.1

  • Fix PyInfo cache incompatibility warnings - by robsdedude. (#​2827)

PyPI release

Full Changelog: pypa/virtualenv@20.29.0...20.29.1

v20.29.0

Compare Source

Features - 20.29.0

  • Add support for selecting free-threaded Python interpreters, e.g., python3.13t. (#​2809)

Bugfixes - 20.29.0

  • Upgrade embedded wheels:

    • setuptools to 75.8.0 from 75.6.0 (#​2823)

PyPI release

Full Changelog: pypa/virtualenv@20.28.1...20.29.0

v20.28.1

Compare Source

Bugfixes - 20.28.1

  • Skip tcsh tests on broken tcsh versions - by gaborbernat. (#​2814)

PyPI release

Full Changelog: pypa/virtualenv@20.28.0...20.28.1

v20.28.0

Compare Source

Features - 20.28.0

  • Write CACHEDIR.TAG file on creation - by "user:neilramsay. (#​2803)

PyPI release

Full Changelog: pypa/virtualenv@20.27.2...20.28.0

v20.27.1

Compare Source

Bugfixes - 20.27.1

  • Upgrade embedded wheels:

PyPI release

Full Changelog: pypa/virtualenv@20.27.0...20.27.1

v20.27.0

Compare Source

Features - 20.27.0

  • Drop 3.7 support as the CI environments no longer allow it running - by gaborbernat. (#​2758)

Bugfixes - 20.27.0

  • When a $PATH entry cannot be checked for existence, skip it instead of terminating - by hroncok.
    (#​2782)

  • Upgrade embedded wheels:

    • setuptools to 75.2.0 from 75.1.0
    • Removed pip of 24.0
    • Removed setuptools of 68.0.0
    • Removed wheel of 0.42.0
    • by gaborbernat. (#​2783)

  • Fix zipapp is broken on Windows post distlib 0.3.9 - by gaborbernat. (#​2784)

PyPI release

Full Changelog: pypa/virtualenv@20.26.6...20.27.0

v20.26.6

Compare Source

Bugfixes - 20.26.6

  • Properly quote string placeholders in activation script templates to mitigate potential command injection - by
    y5c4l3. (#​2768)

PyPI release

Full Changelog: pypa/virtualenv@20.26.5...20.26.6

v20.26.5

Compare Source

Bugfixes - 20.26.5

  • Upgrade embedded wheels: setuptools to 75.1.0 from 74.1.2 - by gaborbernat. (#​2765)

PyPI release

Full Changelog: pypa/virtualenv@20.26.4...20.26.5

v20.26.4

Compare Source

Bugfixes - 20.26.4

  • no longer create () output in console during activation of a virtualenv by .bat file. (#​2728)

  • Upgrade embedded wheels:

    • wheel to 0.44.0 from 0.43.0
    • pip to 24.2 from 24.1
    • setuptools to 74.1.2 from 70.1.0 (#​2760)

PyPI release

Full Changelog: pypa/virtualenv@20.26.3...20.26.4

v20.26.3

Compare Source

Bugfixes - 20.26.3

  • Upgrade embedded wheels:

    • setuptools to 70.1.0 from 69.5.1
    • pip to 24.1 from 24.0 (#​2741)

PyPI release

Full Changelog: pypa/virtualenv@20.26.2...20.26.3

v20.26.2

Compare Source

Bugfixes - 20.26.2

  • virtualenv.pyz no longer fails when zipapp path contains a symlink - by HandSonic and petamas.
    (#​1949)
  • Fix bad return code from activate.sh if hashing is disabled - by :user:'fenkes-ibm'. (#​2717)

PyPI release

Full Changelog: pypa/virtualenv@20.26.1...20.26.2

v20.26.1

Compare Source

Bugfixes - 20.26.1

  • fix PATH-based Python discovery on Windows - by ofek. (#​2712)

PyPI release

Full Changelog: pypa/virtualenv@20.26.0...20.26.1

v20.26.0

Compare Source

Bugfixes - 20.26.0

  • allow builtin discovery to discover specific interpreters (e.g. python3.12) given an unspecific spec (e.g.
    python3) - by flying-sheep. (#​2709)

PyPI release

Full Changelog: pypa/virtualenv@20.25.3...20.26.0

v20.25.3

Compare Source

Bugfixes - 20.25.3

  • Python 3.13.0a6 renamed pathmod to parser. (#​2702)

PyPI release

Full Changelog: pypa/virtualenv@20.25.2...20.25.3

v20.25.2

Compare Source

Bugfixes - 20.25.2

  • Upgrade embedded wheels:

    • setuptools of 69.1.0 to 69.5.1
    • wheel of 0.42.0 to 0.43.0 (#​2699)

PyPI release

Full Changelog: pypa/virtualenv@20.25.1...20.25.2

v20.25.1

Compare Source

Bugfixes - 20.25.1

  • Upgrade embedded wheels:

    • setuptools to 69.0.3 from 69.0.2
    • pip to 23.3.2 from 23.3.1 (#​2681)

  • Upgrade embedded wheels:

    • pip 23.3.2 to 24.0,
    • setuptools 69.0.3 to 69.1.0. (#​2691)

Misc - 20.25.1

PyPI release

Full Changelog: pypa/virtualenv@20.25.0...20.25.1

v20.25.0

Compare Source

Features - 20.25.0

  • The tests now pass on the CI with Python 3.13.0a2 - by hroncok. (#​2673)

Bugfixes - 20.25.0

  • Upgrade embedded wheels:

    • wheel to 0.41.3 from 0.41.2 (#​2665)

  • Upgrade embedded wheels:

    • wheel to 0.42.0 from 0.41.3
    • setuptools to 69.0.2 from 68.2.2 (#​2669)

PyPI release

Full Changelog: pypa/virtualenv@20.24.7...20.25.0

v20.24.7

Compare Source

Bugfixes - 20.24.7

- Upgrade embedded wheels:

  * wheel to `0.41.3` from `0.41.2` (#&#8203;2665)

[PyPI release](https://pypi.org/project/virtualenv/20.24.7/)

**Full Changelog**: https://github.com/pypa/virtualenv/compare/20.24.6...20.24.7

v20.24.6

Compare Source

Bugfixes - 20.24.6

  • Use get_hookimpls method instead of the private attribute in tests. (#​2649)

  • Upgrade embedded wheels:

    • setuptools to 68.2.2 from 68.2.0
    • pip to 23.3.1 from 23.2.1 (#​2656)

PyPI release

Full Changelog: pypa/virtualenv@20.24.5...20.24.6

v20.24.5

Compare Source

Bugfixes - 20.24.5

  • Declare PyPy 3.10 support - by cclauss. (#​2638)

  • Brew on macOS no longer allows copy builds - disallow choosing this by gaborbernat. (#​2640)

  • Upgrade embedded wheels:

    • setuptools to 68.2.0 from 68.1.2 (#​2642)

PyPI release

Full Changelog: pypa/virtualenv@20.24.4...20.24.5

v20.24.4

Compare Source

Bugfixes - 20.24.4

  • Upgrade embedded wheels:

    • setuptools to 68.1.2 from 68.1.0 on 3.8+
    • wheel to 0.41.2 from 0.41.1 on 3.7+ (#​2628)

PyPI release

Full Changelog: pypa/virtualenv@20.24.3...20.24.4

v20.24.3

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.24.2...20.24.3

v20.24.2

Compare Source

What's Changed

Full Changelog: pypa/virtualenv@20.24.1...20.24.2

v20.24.1

Compare Source

What's Changed
New Contributors

Full Changelog: pypa/virtualenv@20.24.0...20.24.1

v20.24.0

Compare Source

What's Changed
New Contributors

Full Changelog: pypa/virtualenv@20.23.1...20.24.0

v20.23.1

Compare Source

What's Changed
New Contributors

Full Changelog: pypa/virtualenv@20.23.0...20.23.1

v20.23.0

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.22.0...20.23.0

v20.22.0

Compare Source

What's Changed

Full Changelog: pypa/virtualenv@20.21.1...20.22.0

v20.21.1

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.21.0...20.21.1

v20.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.20.0...20.21.0

v20.20.0

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.19.0...20.20.0

v20.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.18.0...20.19.0

v20.18.0

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.17.1...20.18.0

v20.17.1

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.17.0...20.17.1

v20.17.0

Compare Source

What's Changed

Full Changelog: pypa/virtualenv@20.16.7...20.17.0

v20.16.7

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.16.6...20.16.7

v20.16.6

Compare Source

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.16.5...20.16.6

v20.16.5

Compare Source

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants