From 45909e98d3b0a35603ad42e741d6d619b0a688bd Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Thu, 5 Nov 2026 01:00:05 -0800 Subject: [PATCH] python3-virtualenv: Ignore CVE-2026-102937 Analysis: - The advisory [1] describes command injection when Windows cmd.exe executes a generated activate.bat file. - BatchActivator.supports() rejects Linux interpreters, so the Linux CLI does not select this activator. - Limit the status to Linux TARGET_OS values. Leave other platforms, including MinGW SDK builds, unexcluded. - The upstream fix is [2]; no backport is needed for Linux activation. Reference: [1] https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q [2] https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6 Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- .../recipes-devtools/python/python3-virtualenv_21.2.1.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb index adeff3939a..1a8091adcc 100644 --- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb +++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb @@ -52,3 +52,6 @@ RDEPENDS:${PN} += " \ " CVE_PRODUCT = "virtualenv" + +# The batch activator only supports Windows interpreters. +CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}"