virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated
    activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an
    additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches
    __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted
    Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the
    data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation
    script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.
    (CVE-2026-102925)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated     activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an     additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches
    __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted     Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the     data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation     script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.
    (CVE-2026-102925)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472548	Chainguard: multiple py3-cassandra-medusa packages, request-1276: security update to 0.30.1-r3	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
472548	Chainguard: multiple py3-cassandra-medusa packages, request-1276: security update to 0.30.1-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
471142	Echo: virtualenv: security update to 21.7.13	Tenable Cloud Security	Echo Local Security Checks	Local	high
471142	Echo: virtualenv: security update to 21.7.13	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
358347	Linux Distros Unpatched Vulnerability : CVE-2026-102925	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102925

high

Tenable Plugins

high

high

high

high

high