virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12,
    BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set
    "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding
    configuration value can include a double quote that closes the assignment and leaves following cmd.exe
    operators as executable syntax. When a user activates the generated Windows environment, the injected
    commands run with that user's privileges. This issue is fixed in version 21.7.12. (CVE-2026-102937)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12,     BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set     VAR=value statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding     configuration value can include a double quote that closes the assignment and leaves following cmd.exe     operators as executable syntax. When a user activates the generated Windows environment, the injected     commands run with that user's privileges. This issue is fixed in version 21.7.12. (CVE-2026-102937)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
472217	Chainguard: multiple py3-cassandra-medusa packages: security update to 0.30.1-r3	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
472217	Chainguard: multiple py3-cassandra-medusa packages: security update to 0.30.1-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
471103	Echo: virtualenv: security update to 21.7.12	Tenable Cloud Security	Echo Local Security Checks	Local	high
471103	Echo: virtualenv: security update to 21.7.12	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
358386	Linux Distros Unpatched Vulnerability : CVE-2026-102937	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-102937

high

Tenable Plugins

high

high

high

high

high