A vulnerability in virtualenv's xonsh activation script allows attacker-controlled prompt text to become executable code during environment activation if the xonsh source decoding uses legacy multibyte encodings like GBK or Big5. This occurs because UTF-8 encoded activation scripts containing non-ASCII characters are misinterpreted under these encodings, causing string literals to be improperly closed and arbitrary statements to execute. The issue affects POSIX activation scripts and requires an attacker to control the prompt or destination argument passed to virtualenv, with the user subsequently activating the environment. A fix is available in virtualenv version 2.29.3.
CVE-2026-113717 is a vulnerability in virtualenv's pip seeder when used with the --download option. The issue arises because virtualenv skips wheel digest verification for wheels downloaded via pip's index lookup, allowing an attacker-controlled index to serve a modified pip wheel without detection. Both --seeder pip and --download options must be enabled for exploitation. The vulnerability was reported by Anthropic's OSS Scanner and fixed in virtualenv version 2.29.3.
A vulnerability in virtualenv's wheel download and caching mechanism allows a downloaded wheel to be cached before verification completes. This can lead to a modified or unverified wheel being reused later, potentially causing execution of tampered code. The issue arises because virtualenv selects the verification target from pip's textual output rather than the actual downloaded file, and verification failures do not remove the cached file. A fix is available in version 2.29.3.
A buffer overflow vulnerability exists in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, potentially leading to sensitive memory disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1. The vulnerability has a critical severity with a CVSS 4.0 score of 9.2.
FastMCP versions 3.0.0–3.4.9 and 4.0.0–4.1.1 have an authorization vulnerability where direct calls to transformed components skip the final authorization check. This allows low-privilege users to invoke protected tools, resources, templates, or prompts that should be denied. The issue arises because the server applies transforms to components but does not reauthorize the transformed component before returning it on direct lookups. Fixes are available in FastMCP 3.4.10 and 4.1.2.
CVE-2026-115355 is a vulnerability in the Include directive of the Mistune markdown parser used in recon-ng. It allows path traversal via '../' sequences to read arbitrary files outside the intended source directory. Additionally, error messages and included file contents are rendered without HTML escaping, enabling cross-site scripting (XSS) even when escaping is enabled. The Include plugin must be explicitly enabled to be exploitable. A fix is available in version 5.1.2_4.
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.
The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available.
An attacker able to intercept or redirect client traffic may use these keys to impersonate a TLS server.
LWP, HTTP::Tiny and other clients normally use IO::Socket::SSL, which looks for CA certificates in OpenSSL's default locations before falling back to Mozilla::CA.
Configuration and environment variables can override this selection. Users should check which CA store their client uses. If it uses the system store, check for and install the operating system vendor's updates for this incident.
A vulnerability in virtualenv's app-data copy seeder causes files copied from a cached wheel to retain file permissions from the cache, which may be more permissive than intended. This occurs because shutil.copy preserves the cached file modes regardless of the current umask. If the cache was created under a permissive umask (e.g., 000), files in later environments can be writable by other local accounts, potentially allowing unauthorized code modification and execution. The issue affects virtualenv versions from 2018.11.26_4 up to but not including 2026.10.1. A fix is available in version 2026.10.1 that enforces stricter file permissions when copying from the cache.
CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder that improperly deletes files outside the intended environment during seed package removal. It occurs when existing distribution metadata contains paths that traverse outside the environment, allowing deletion of arbitrary files accessible by the invoking user. This affects virtualenv versions from 2021.11.9 up to but not including 2026.10.1. The issue was fixed in version 2026.10.1.
A vulnerability in virtualenv's venv creator allows attacker-controlled pathnames containing Unicode line boundary characters (e.g., U+2028) to inject additional configuration keys into the pyvenv.cfg file during configuration readback. This can alter environment settings such as the 'home' directory and 'include-system-site-packages', potentially changing which standard library files the interpreter loads and weakening environment isolation. The issue affects virtualenv versions from 2022.9.24 up to but not including 2026.10.1. A fix was introduced in version 2026.10.1 that rejects line-boundary characters before creation and rebuilds the configuration from selected settings.
### Summary
On Windows, attacker-controlled content in a wheel's
`.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel
installation path to create an `__init__.py` outside the requested
`destination_eggdir`.
The attacker can influence the destination path, but not the contents of
the created file.
### Details
Tested setuptools commit:
`6ead555c5fb29bc57fe6105b1bffc163f56fd558`
Relevant source:
`setuptools/wheel.py`
SHA-256:
`359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd`
The relevant call path is:
`Wheel(wheel_path).install_as_egg(destination)`
→ `_install_as_egg`
→ `_convert_metadata`
→ `_fix_namespace_packages`
A wheel can provide attacker-controlled content in:
`<distribution>.dist-info/namespace_packages.txt`
The namespace value is eventually used approximately as:
```python
mod_dir = os.path.join(destination_eggdir, *mod.split('.'))
mod_init = os.path.join(mod_dir, '__init__.py')
If mod is a Windows drive-qualified absolute path containing no dots,
mod.split('.') preserves it as a single component.
On Windows, os.path.join(destination_eggdir, absolute_component) discards
the original base directory and resolves to the attacker-supplied absolute
path.
The existing wheel filename and ZIP traversal checks do not validate this
metadata value before it is subsequently interpreted as a filesystem path.
```markdown
### PoC
The reproduction was performed entirely inside a disposable temporary
directory.
Layout:
```text
sandbox/
destination/
outside/
input/
canary.txt
```
A synthetic wheel was created containing:
`demo_pkg-1.0.dist-info/namespace_packages.txt`
whose content was the absolute path of:
`sandbox\outside`
The real acquired setuptools implementation was then invoked:
```python
setuptools.wheel.Wheel(synthetic_wheel).install_as_egg(
sandbox_destination
)
```
The operation completed without exception.
Expected metadata was created under:
`sandbox\destination\EGG-INFO`
but setuptools also created:
`sandbox\outside\__init__.py`
The file did not exist before execution.
Its contents were:
```python
__import__('pkg_resources').declare_namespace(__name__)
```
The unrelated canary remained byte-identical.
The sandbox was deleted after recording the evidence.
```
### Impact
A crafted wheel can cause setuptools to create a fixed-content
`__init__.py` outside the intended installation directory at a
filesystem path influenced by the wheel, with the permissions of the
process performing the installation.
The demonstrated reproduction required the target parent directory to
already exist.
### Summary
On Windows, attacker-controlled content in a wheel's
`.dist-info/namespace_packages.txt` can cause setuptools' legacy wheel
installation path to create an `__init__.py` outside the requested
`destination_eggdir`.
The attacker can influence the destination path, but not the contents of
the created file.
### Details
Tested setuptools commit:
`6ead555c5fb29bc57fe6105b1bffc163f56fd558`
Relevant source:
`setuptools/wheel.py`
SHA-256:
`359b7e0d5dd8c3135653abe08a8ed5dc0352eadfd7df22cb5e2b5303b7c3cafd`
The relevant call path is:
`Wheel(wheel_path).install_as_egg(destination)`
→ `_install_as_egg`
→ `_convert_metadata`
→ `_fix_namespace_packages`
A wheel can provide attacker-controlled content in:
`<distribution>.dist-info/namespace_packages.txt`
The namespace value is eventually used approximately as:
```python
mod_dir = os.path.join(destination_eggdir, *mod.split('.'))
mod_init = os.path.join(mod_dir, '__init__.py')
If mod is a Windows drive-qualified absolute path containing no dots,
mod.split('.') preserves it as a single component.
On Windows, os.path.join(destination_eggdir, absolute_component) discards
the original base directory and resolves to the attacker-supplied absolute
path.
The existing wheel filename and ZIP traversal checks do not validate this
metadata value before it is subsequently interpreted as a filesystem path.
```markdown
### PoC
The reproduction was performed entirely inside a disposable temporary
directory.
Layout:
```text
sandbox/
destination/
outside/
input/
canary.txt
```
A synthetic wheel was created containing:
`demo_pkg-1.0.dist-info/namespace_packages.txt`
whose content was the absolute path of:
`sandbox\outside`
The real acquired setuptools implementation was then invoked:
```python
setuptools.wheel.Wheel(synthetic_wheel).install_as_egg(
sandbox_destination
)
```
The operation completed without exception.
Expected metadata was created under:
`sandbox\destination\EGG-INFO`
but setuptools also created:
`sandbox\outside\__init__.py`
The file did not exist before execution.
Its contents were:
```python
__import__('pkg_resources').declare_namespace(__name__)
```
The unrelated canary remained byte-identical.
The sandbox was deleted after recording the evidence.
```
### Impact
A crafted wheel can cause setuptools to create a fixed-content
`__init__.py` outside the intended installation directory at a
filesystem path influenced by the wheel, with the permissions of the
process performing the installation.
The demonstrated reproduction required the target parent directory to
already exist.