python3-virtualenv: Ignore CVE-2026-113718

Analysis:
- The advisory [1] limits this issue to Xonsh activation in versions
  21.3.0 through 21.14.8.
- Version 21.2.1 has no Xonsh activator, activate.xsh template or
  registered entry point. None of the existing backports adds them.
- The upstream fix [2] changes the absent Xonsh quoting code, so it
  is not applicable to this recipe.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf
[2] https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar authored and Anuj Mittal committed 2026-11-09 09:10:39 +05:30
1 parent 45909e98d3
commit c50217eae4
1 file changed
+1
@@ -55,3 +55,4 @@ CVE_PRODUCT = "virtualenv"
# The batch activator only supports Windows interpreters.
CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}"
CVE_STATUS[CVE-2026-113718] = "not-applicable-config: Xonsh activation was introduced in virtualenv 21.3.0 and is absent from 21.2.1"