{"id":"AZL-105648","summary":"CVE-2026-102937 affecting package python-pip 24.2-10","details":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set \"VAR=value\" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.","modified":"2026-10-04T05:34:07Z","published":"2026-09-29T21:17:18Z","upstream":["CVE-2026-102937"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102937"}],"affected":[{"package":{"name":"python-pip","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-pip"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.2-10"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105648.json"}}],"schema_version":"1.9.0"}