{
  "@id": "urn:uuid:bf0d5ab5-c18e-4f32-afb2-9f6af5c7e7d6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-27T13:21:32.362993+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-09T07:18:00.126700+00:00",
      "status_notes": "Vulnerability AIKIDO-2026-10495 is fixed in version 20.39.1.post3+tuxcare of virtualenv.",
      "vulnerability": {
        "name": "AIKIDO-2026-10495"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-09T07:18:00.126700+00:00",
      "status_notes": "Vulnerability CVE-2026-102925 is fixed in version 20.39.1.post3+tuxcare of virtualenv.",
      "vulnerability": {
        "name": "CVE-2026-102925"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-09T07:18:00.126700+00:00",
      "status_notes": "Vulnerability CVE-2026-102930 is fixed in version 20.39.1.post3+tuxcare of virtualenv.",
      "vulnerability": {
        "name": "CVE-2026-102930"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-09T07:18:00.126700+00:00",
      "status_notes": "Vulnerability CVE-2026-102937 is fixed in version 20.39.1.post3+tuxcare of virtualenv.",
      "vulnerability": {
        "name": "CVE-2026-102937"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-09T07:18:00.126700+00:00",
      "status_notes": "Vulnerability CVE-2026-102938 is fixed in version 20.39.1.post3+tuxcare of virtualenv.",
      "vulnerability": {
        "name": "CVE-2026-102938"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T13:21:20.563263+00:00",
      "status_notes": "Vulnerability CVE-2026-113714 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113714"
      },
      "action_statement": "Vulnerability CVE-2026-113714 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T13:21:32.362993+00:00",
      "status_notes": "Vulnerability CVE-2026-113715 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113715"
      },
      "action_statement": "Vulnerability CVE-2026-113715 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T13:21:12.766719+00:00",
      "status_notes": "Vulnerability CVE-2026-113716 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113716"
      },
      "action_statement": "Vulnerability CVE-2026-113716 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T13:21:20.563263+00:00",
      "status_notes": "Vulnerability CVE-2026-113717 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113717"
      },
      "action_statement": "Vulnerability CVE-2026-113717 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-23T22:50:18.455196+00:00",
      "status_notes": "Vulnerability CVE-2026-113718 does not affect version 20.39.1.post3+tuxcare of virtualenv. not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-113718"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T13:21:12.766719+00:00",
      "status_notes": "Vulnerability CVE-2026-113719 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113719"
      },
      "action_statement": "Vulnerability CVE-2026-113719 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T13:21:32.362993+00:00",
      "status_notes": "Vulnerability CVE-2026-113720 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113720"
      },
      "action_statement": "Vulnerability CVE-2026-113720 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T13:21:12.766719+00:00",
      "status_notes": "Vulnerability CVE-2026-113721 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113721"
      },
      "action_statement": "Vulnerability CVE-2026-113721 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T13:21:12.766719+00:00",
      "status_notes": "Vulnerability CVE-2026-113722 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113722"
      },
      "action_statement": "Vulnerability CVE-2026-113722 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T11:42:44.741580+00:00",
      "status_notes": "Vulnerability CVE-2026-113723 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113723"
      },
      "action_statement": "Vulnerability CVE-2026-113723 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T11:42:44.741580+00:00",
      "status_notes": "Vulnerability CVE-2026-113724 does not affect version 20.39.1.post3+tuxcare of virtualenv. CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-113724"
      },
      "impact_statement": "CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-22T07:15:15.426797+00:00",
      "status_notes": "Vulnerability CVE-2026-113725 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-113725"
      },
      "action_statement": "Vulnerability CVE-2026-113725 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-22T06:54:00.184154+00:00",
      "status_notes": "Vulnerability CVE-2026-113726 is fixed in version 20.39.1.post3+tuxcare of virtualenv.",
      "vulnerability": {
        "name": "CVE-2026-113726"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-22T06:54:00.184154+00:00",
      "status_notes": "Vulnerability CVE-2026-113732 is fixed in version 20.39.1.post3+tuxcare of virtualenv.",
      "vulnerability": {
        "name": "CVE-2026-113732"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-22T06:53:00.109738+00:00",
      "status_notes": "Vulnerability CVE-2026-113776 is fixed in version 20.39.1.post3+tuxcare of virtualenv.",
      "vulnerability": {
        "name": "CVE-2026-113776"
      }
    }
  ]
}