{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"python-virtualenv","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQAX5JMCV9QE1G95T8MA13","modified_at":"2026-10-23T18:05:10.560038714Z","published_at":"2026-10-20T20:17:19.257Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-113725","https://security-tracker.debian.org/tracker/CVE-2026-113725"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-113725","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-113725"}],"summary":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a"}