From c50217eae41f3030469f5ca7bb1e2200135fa3ed Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Thu, 5 Nov 2026 01:00:06 -0800 Subject: [PATCH] python3-virtualenv: Ignore CVE-2026-113718 Analysis: - The advisory [1] limits this issue to Xonsh activation in versions 21.3.0 through 21.14.8. - Version 21.2.1 has no Xonsh activator, activate.xsh template or registered entry point. None of the existing backports adds them. - The upstream fix [2] changes the absent Xonsh quoting code, so it is not applicable to this recipe. Reference: [1] https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf [2] https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0 Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb index 1a8091adcc..b554c3a4f8 100644 --- a/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb +++ b/meta-python/recipes-devtools/python/python3-virtualenv_21.2.1.bb @@ -55,3 +55,4 @@ CVE_PRODUCT = "virtualenv" # The batch activator only supports Windows interpreters. CVE_STATUS[CVE-2026-102937] = "${@'not-applicable-platform: Windows cmd.exe batch activation is not selected for Linux interpreters' if (d.getVar('TARGET_OS') or '').startswith('linux') else ''}" +CVE_STATUS[CVE-2026-113718] = "not-applicable-config: Xonsh activation was introduced in virtualenv 21.3.0 and is absent from 21.2.1"