{"url":"https://pypi.sbomify.com/package/virtualenv/21.15.6","markdown_url":"https://pypi.sbomify.com/package/virtualenv/21.15.6.md","name":"virtualenv","version":"21.15.6","purl":"pkg:pypi/virtualenv@21.15.6","summary":"Virtual Python Environment builder","author":null,"project_urls":{"Changelog":"https://virtualenv.pypa.io/en/latest/changelog.html","Documentation":"https://virtualenv.pypa.io","Funding":"https://github.com/sponsors/gaborbernat","Homepage":"https://github.com/pypa/virtualenv","Source":"https://github.com/pypa/virtualenv","Tidelift":"https://tidelift.com/funding/github/pypi/virtualenv","Tracker":"https://github.com/pypa/virtualenv/issues","thanks.dev":"https://thanks.dev/u/gh/gaborbernat"},"requires_python":">=3.9","license":null,"classifiers":["Development Status :: 5 - Production/Stable","Intended Audience :: Developers","Operating System :: MacOS :: MacOS X","Operating System :: Microsoft :: Windows","Operating System :: POSIX","Programming Language :: Python :: 3 :: Only","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.13","Programming Language :: Python :: 3.14","Programming Language :: Python :: 3.15","Programming Language :: Python :: 3.9","Programming Language :: Python :: Implementation :: CPython","Programming Language :: Python :: Implementation :: PyPy","Topic :: Software Development :: Libraries","Topic :: Software Development :: Testing","Topic :: Utilities"],"wheels":[{"filename":"virtualenv-21.15.6-py3-none-any.whl","url":"https://files.pythonhosted.org/packages/0a/63/fd514dee3159f74a96ac01beb8f460b65e4ef0b972f63f4fe9f0cd2aa0e3/virtualenv-21.15.6-py3-none-any.whl","sboms":[{"artifact_uuid":"41ea754e-1700-5438-addc-40c94dfb6d58","path":"virtualenv-21.15.6.dist-info/sboms/virtualenv.cdx.json","format":"CycloneDX/1.6","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/41ea754e-1700-5438-addc-40c94dfb6d58/download","vulnerability_count":22,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"pypa/virtualenv","workflow":"release.yaml","environment":"release","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/pypa/virtualenv/.github/workflows/release.yaml@refs/tags/21.15.6","1.3.6.1.4.1.57264.1.10":"9a4852e189e927f142313d18e76080eb15130bd4","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/pypa/virtualenv","1.3.6.1.4.1.57264.1.13":"9a4852e189e927f142313d18e76080eb15130bd4","1.3.6.1.4.1.57264.1.14":"refs/tags/21.15.6","1.3.6.1.4.1.57264.1.15":"1446474","1.3.6.1.4.1.57264.1.16":"https://github.com/pypa","1.3.6.1.4.1.57264.1.17":"647025","1.3.6.1.4.1.57264.1.18":"https://github.com/pypa/virtualenv/.github/workflows/release.yaml@refs/tags/21.15.6","1.3.6.1.4.1.57264.1.19":"9a4852e189e927f142313d18e76080eb15130bd4","1.3.6.1.4.1.57264.1.20":"push","1.3.6.1.4.1.57264.1.21":"https://github.com/pypa/virtualenv/actions/runs/42269022567/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}}],"formats":["CycloneDX"],"sbom_count":1,"has_attestation":true,"vulnerabilities":[{"id":"PYSEC-2026-4320","aliases":["GHSA-6q48-6c7w-9gw2"],"summary":"certifi bundles emSign root CAs with compromised intermediate CA keys","severity":"critical","score":9.1,"package":"certifi","version":"2026.1.4","ecosystem":"PyPI","purl":"pkg:pypi/certifi@2026.1.4","fixed":["2026.10.18"],"url":"https://osv.dev/vulnerability/PYSEC-2026-4320","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2025-66418","aliases":["GHSA-gm62-xv2j-4w53","PYSEC-2026-1998"],"summary":"urllib3 allows an unbounded number of links in the decompression chain","severity":"high","score":8.9,"package":"urllib3","version":"1.26.20","ecosystem":"PyPI","purl":"pkg:pypi/urllib3@1.26.20","fixed":["2.6.0"],"url":"https://insights.sbomify.com/CVE-2025-66418/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2025-66471","aliases":["GHSA-2xpw-w6gg-jr37","PYSEC-2026-1994"],"summary":"urllib3 streaming API improperly handles highly compressed data","severity":"high","score":8.9,"package":"urllib3","version":"1.26.20","ecosystem":"PyPI","purl":"pkg:pypi/urllib3@1.26.20","fixed":["2.6.0"],"url":"https://insights.sbomify.com/CVE-2025-66471/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-21441","aliases":["GHSA-38jv-5279-wg99","PYSEC-2026-1996"],"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","severity":"high","score":8.9,"package":"urllib3","version":"1.26.20","ecosystem":"PyPI","purl":"pkg:pypi/urllib3@1.26.20","fixed":["2.6.3"],"url":"https://insights.sbomify.com/CVE-2026-21441/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-97689","aliases":["GHSA-vxq7-64xx-v4gw","PYSEC-2026-4177"],"summary":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","severity":"high","score":8.9,"package":"urllib3","version":"1.26.20","ecosystem":"PyPI","purl":"pkg:pypi/urllib3@1.26.20","fixed":["2.8.0"],"url":"https://insights.sbomify.com/CVE-2026-97689/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2025-47273","aliases":["BIT-setuptools-2025-47273","GHSA-5rjg-fvgr-3xxf","PYSEC-2025-49"],"summary":"setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write","severity":"high","score":8.8,"package":"setuptools","version":"70.3.0","ecosystem":"PyPI","purl":"pkg:pypi/setuptools@70.3.0","fixed":["78.1.1"],"url":"https://insights.sbomify.com/CVE-2025-47273/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-44431","aliases":["GHSA-qccp-gfcp-xxvc","PYSEC-2026-141"],"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","severity":"high","score":8.2,"package":"urllib3","version":"1.26.20","ecosystem":"PyPI","purl":"pkg:pypi/urllib3@1.26.20","fixed":["2.7.0"],"url":"https://insights.sbomify.com/CVE-2026-44431/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-8643","aliases":["GHSA-wf93-45jw-7689","PYSEC-2026-196"],"summary":" pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory","severity":"high","score":8.0,"package":"pip","version":"26.0.1","ecosystem":"PyPI","purl":"pkg:pypi/pip@26.0.1","fixed":["26.1.2"],"url":"https://insights.sbomify.com/CVE-2026-8643/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-97687","aliases":["GHSA-8988-9cw3-xx77","PYSEC-2026-4175"],"summary":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","severity":"high","score":7.6,"package":"urllib3","version":"1.26.20","ecosystem":"PyPI","purl":"pkg:pypi/urllib3@1.26.20","fixed":["2.8.0"],"url":"https://insights.sbomify.com/CVE-2026-97687/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-114613","aliases":["GHSA-j586-36cw-2gc2"],"summary":"MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure","severity":"high","score":7.5,"package":"msgpack","version":"1.1.2","ecosystem":"PyPI","purl":"pkg:pypi/msgpack@1.1.2","fixed":["1.2.3"],"url":"https://insights.sbomify.com/CVE-2026-114613/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-57585","aliases":["GHSA-6v7p-g79w-8964","PYSEC-2026-3625"],"summary":"MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error","severity":"high","score":7.5,"package":"msgpack","version":"1.1.2","ecosystem":"PyPI","purl":"pkg:pypi/msgpack@1.1.2","fixed":["1.2.1"],"url":"https://insights.sbomify.com/CVE-2026-57585/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-45409","aliases":["GHSA-65pc-fj4g-8rjx","PYSEC-2026-215"],"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","severity":"medium","score":6.9,"package":"idna","version":"3.11","ecosystem":"PyPI","purl":"pkg:pypi/idna@3.11","fixed":["3.15"],"url":"https://insights.sbomify.com/CVE-2026-45409/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-13346","aliases":["GHSA-qwm4-qh6w-59xr","PYSEC-2026-3721"],"summary":"pip would incorrectly handle doubly-encoded package URLs from indexes","severity":"medium","score":6.5,"package":"pip","version":"26.0.1","ecosystem":"PyPI","purl":"pkg:pypi/pip@26.0.1","fixed":["26.2","26.2.0"],"url":"https://insights.sbomify.com/CVE-2026-13346/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-59890","aliases":["BIT-setuptools-2026-59890","GHSA-h35f-9h28-mq5c","PYSEC-2026-3447"],"summary":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","severity":"medium","score":6.1,"package":"setuptools","version":"70.3.0","ecosystem":"PyPI","purl":"pkg:pypi/setuptools@70.3.0","fixed":["83.0.0"],"url":"https://insights.sbomify.com/CVE-2026-59890/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-59890","aliases":["BIT-setuptools-2026-59890","GHSA-h35f-9h28-mq5c","PYSEC-2026-3447"],"summary":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","severity":"medium","score":6.1,"package":"setuptools","version":"82.0.1","ecosystem":"PyPI","purl":"pkg:pypi/setuptools@82.0.1","fixed":["83.0.0"],"url":"https://insights.sbomify.com/CVE-2026-59890/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-25645","aliases":["GHSA-gc5v-m9x4-r6x2","PYSEC-2026-2275"],"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","severity":"medium","score":5.5,"package":"requests","version":"2.32.5","ecosystem":"PyPI","purl":"pkg:pypi/requests@2.32.5","fixed":["2.33.0"],"url":"https://insights.sbomify.com/CVE-2026-25645/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-6357","aliases":["GHSA-jp4c-xjxw-mgf9","PYSEC-2026-2876"],"summary":"pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere","severity":"medium","score":5.3,"package":"pip","version":"26.0.1","ecosystem":"PyPI","purl":"pkg:pypi/pip@26.0.1","fixed":["26.1"],"url":"https://insights.sbomify.com/CVE-2026-6357/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2025-50181","aliases":["GHSA-pq67-6m6q-mj2v","PYSEC-2026-1999"],"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","severity":"medium","score":5.3,"package":"urllib3","version":"1.26.20","ecosystem":"PyPI","purl":"pkg:pypi/urllib3@1.26.20","fixed":["2.5.0"],"url":"https://insights.sbomify.com/CVE-2025-50181/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-3219","aliases":["GHSA-58qw-9mgm-455v","PYSEC-2026-2875"],"summary":"pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files","severity":"medium","score":4.6,"package":"pip","version":"26.0.1","ecosystem":"PyPI","purl":"pkg:pypi/pip@26.0.1","fixed":["26.1"],"url":"https://insights.sbomify.com/CVE-2026-3219/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"CVE-2026-4539","aliases":["GHSA-5239-wwwm-4pmq","PYSEC-2026-2987"],"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","severity":"low","score":3.3,"package":"pygments","version":"2.19.2","ecosystem":"PyPI","purl":"pkg:pypi/pygments@2.19.2","fixed":["2.20.0"],"url":"https://insights.sbomify.com/CVE-2026-4539/","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"GHSA-xmj3-9gf7-h52w","aliases":[],"summary":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","severity":"low","score":1.0,"package":"setuptools","version":"70.3.0","ecosystem":"PyPI","purl":"pkg:pypi/setuptools@70.3.0","fixed":["84.1.0"],"url":"https://osv.dev/vulnerability/GHSA-xmj3-9gf7-h52w","wheels":["virtualenv-21.15.6-py3-none-any.whl"]},{"id":"GHSA-xmj3-9gf7-h52w","aliases":[],"summary":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","severity":"low","score":1.0,"package":"setuptools","version":"82.0.1","ecosystem":"PyPI","purl":"pkg:pypi/setuptools@82.0.1","fixed":["84.1.0"],"url":"https://osv.dev/vulnerability/GHSA-xmj3-9gf7-h52w","wheels":["virtualenv-21.15.6-py3-none-any.whl"]}],"vulnerability_scan":{"scanned_sboms":1,"total_sboms":1,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"critical":1,"high":10,"medium":8,"low":3}}}