StackRadar

CVE-2026-102937

High

Advisory

Published 18 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.3
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
140
of 18,026 indexed, latest versions
Container images
175
deployed by those charts
Fix available
1 of 2
affected packages

virtualenv: Command injection via --prompt in activate.bat (batch activator)

Carried by container images the latest versions of 140 of 18,026 indexed charts deploy, on 175 images.

Affected packageAffected versionsFixed inImages
virtualenvpypi1.11.4, 15.1.0, 16.3.0, 16.6.0+58 more21.7.12175
python-virtualenvdeb1.11.4-1ubuntu1, 20.0.17-1ubuntu0.3, 20.17.1+ds-1, 20.25.0+ds-2+1 moreno fix listed10
OSV records
DEBIAN-CVE-2026-102937GHSA-x78j-v8h9-3j2qUBUNTU-CVE-2026-102937
Also known as
PYSEC-2026-4014

Charts affected

140 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
virtualenv@20.25.1
21.7.12

Open the chart page →

12,488
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
virtualenv@20.28.0
21.7.12

Open the chart page →

12,012
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
virtualenv@20.23.1
21.7.12

Open the chart page →

4,643
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
virtualenv@20.14.1
21.7.12

Open the chart page →

8,930
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
virtualenv@20.32.0
21.7.12

Open the chart page →

6,700
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
virtualenv@20.25.0
21.7.12

Open the chart page →

7,256
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
virtualenv@20.4.0
21.7.12
stackstorm/st2api:3.86f56d239d280
virtualenv@20.4.0
21.7.12
stackstorm/st2auth:3.833ecfda16608
virtualenv@20.4.0
21.7.12
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
virtualenv@20.4.0
21.7.12
stackstorm/st2notifier:3.8f190a6212195
virtualenv@20.4.0
21.7.12
stackstorm/st2rulesengine:3.8259503496ff9
virtualenv@20.4.0
21.7.12
stackstorm/st2scheduler:3.8b1de2055c362
virtualenv@20.4.0
21.7.12
stackstorm/st2sensorcontainer:3.8b1a338f64773
virtualenv@20.4.0
21.7.12
stackstorm/st2stream:3.81c8904a3bf67
virtualenv@20.4.0
21.7.12
stackstorm/st2timersengine:3.81bf35bfaf00c
virtualenv@20.4.0
21.7.12
stackstorm/st2workflowengine:3.819fdfffdbba8
virtualenv@20.4.0
21.7.12

Open the chart page →

750,881
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
virtualenv@21.7.9
21.7.12

Open the chart page →

3,013
awx-operatorawx-operator-helm3.2.11 of 2See more

awx-operator awx-operator-helm 3.2.1

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
virtualenv@20.25.0
21.7.12

Open the chart page →

11,005
py-kube-downscalerpy-kube-downscalerVerified publisher0.3.121 of 1See more

py-kube-downscaler py-kube-downscaler 0.3.12

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/caas-team/py-kube-downscaler:26.4.0af05a098b0d2
virtualenv@21.2.0
21.7.12

Open the chart page →

912
thehivestrangebee-helmOfficialVerified publisher1.1.01 of 7See more

thehive strangebee-helm 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
bitnamilegacy/cassandra:4.1.7-debian-12-r32b7a217999a1
virtualenv@20.28.0
21.7.12

Open the chart page →

16,340
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
virtualenv@20.25.0
21.7.12

Open the chart page →

17,045
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
virtualenv@20.26.3
21.7.12

Open the chart page →

4,667
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
virtualenv@20.14.1
21.7.12

Open the chart page →

9,161
simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher1.6.21 of 3See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/simple-krr-dashboard:1.6.34c625eff5410
virtualenv@21.7.8
21.7.12

Open the chart page →

2,794
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
virtualenv@21.1.0
21.7.12

Open the chart page →

5,609
kiali-operatorkiali2.32.01 of 1See more

kiali-operator kiali 2.32.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
quay.io/kiali/kiali-operator:v2.32.096c5264d54ab
virtualenv@20.29.3
21.7.12

Open the chart page →

1,598
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
redislabs/redisearch:2.4.1433561794c5c8
virtualenv@20.16.3
21.7.12

Open the chart page →

17,557
machinarislib42Verified publisher0.2.01 of 1See more

machinaris lib42 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/guydavis/machinaris:test50a71a30f18e
virtualenv@20.39.1
21.7.12

Open the chart page →

38,381
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
python-virtualenv@20.31.2+ds-1+deb13u1
virtualenv@20.31.2
no fix listed
21.7.12

Open the chart page →

11,838
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
virtualenv@20.35.4
21.7.12

Open the chart page →

4,621
clearml-agentallegroaiVerified publisher5.3.31 of 1See more

clearml-agent allegroai 5.3.3

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
allegroai/clearml-agent-k8s-base:1.24-21772827a01bb5
virtualenv@20.15.0
21.7.12

Open the chart page →

73,213
music-assistantbdclark-helm-chartsVerified publisher0.4.131 of 1See more

music-assistant bdclark-helm-charts 0.4.13

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.3885872224fa5
virtualenv@21.7.9
21.7.12

Open the chart page →

4,547
squestchristianhuthVerified publisher6.6.81 of 4See more

squest christianhuth 6.6.8

1 of the 4 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
virtualenv@20.39.1
21.7.12

Open the chart page →

11,957
mealiedeimosfr-charts1.0.161 of 1See more

mealie deimosfr-charts 1.0.16

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.28.08b02290f4d18
virtualenv@21.7.10
21.7.12

Open the chart page →

3,693
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
virtualenv@20.15.1
21.7.12

Open the chart page →

7,557
eoapieoapiOfficialVerified publisher0.16.41 of 7See more

eoapi eoapi 0.16.4

1 of the 7 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
virtualenv@21.7.0
21.7.12

Open the chart page →

4,497
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
virtualenv@20.39.1
21.7.12

Open the chart page →

926
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
virtualenv@20.35.4
21.7.12

Open the chart page →

8,120
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
virtualenv@20.36.1
21.7.12

Open the chart page →

68,187
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
virtualenv@20.29.1
21.7.12

Open the chart page →

3,034
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
virtualenv@20.36.1
21.7.12

Open the chart page →

8,008
locustlocustVerified publisher0.1.41 of 1See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
hansehe/locust:1.1.0bc8e45262bc4
virtualenv@20.29.3
21.7.12

Open the chart page →

3,094
home-assistantloeken-at-homeVerified publisher2026.5.11 of 1See more

home-assistant loeken-at-home 2026.5.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.5.14ce6abc553b3
virtualenv@21.3.1
21.7.12

Open the chart page →

3,890
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
growthbook/growthbook:latest67b7cd7d12a1
virtualenv@20.39.1
21.7.12

Open the chart page →

1,550
opta-agentopta-agentVerified publisher0.1.31 of 1See more

opta-agent opta-agent 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
runx1/opta-agent:latest0ca3867d3200
virtualenv@20.14.1
21.7.12

Open the chart page →

2,014
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
treskon/portrait-pythonruntime:DEV-latest694c098bcb52
virtualenv@21.7.4
21.7.12
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
virtualenv@20.29.2
21.7.12

Open the chart page →

36,111
kube-resource-reportrlex0.10.11 of 2See more

kube-resource-report rlex 0.10.1

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
hjacobs/kube-resource-report:22.11.0c173cd02f5af
virtualenv@20.17.0
21.7.12

Open the chart page →

1,494
alertasomeblackmagic0.2.31 of 2See more

alerta someblackmagic 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
alerta/alerta-web:8.5.04786b9eaa606
virtualenv@20.10.0
21.7.12

Open the chart page →

4,277
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
python-virtualenv@20.0.17-1ubuntu0.3
virtualenv@20.0.17
no fix listed
21.7.12

Open the chart page →

105,042
switcher-slack-appswitcherapiOfficialVerified publisher1.1.51 of 1See more

switcher-slack-app switcherapi 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
trackerforce/switcher-slack-app:latest4d99efa5eb70
virtualenv@21.7.9
21.7.12

Open the chart page →

135
verbacapverbacapVerified publisher1.0.71 of 1See more

verbacap verbacap 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
virtualenv@20.26.1
21.7.12

Open the chart page →

2,475
waldurwaldur-chartsVerified publisher8.1.21 of 3See more

waldur waldur-charts 8.1.2

1 of the 3 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
opennode/waldur-mastermind:8.1.24c82b15d9042
virtualenv@21.7.4
21.7.12

Open the chart page →

5,787
airbyteairbyte-v2Verified publisher2.3.01 of 10See more

airbyte airbyte-v2 2.3.0

1 of the 10 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.28.2deec511b51c3
virtualenv@20.39.1
21.7.12

Open the chart page →

14,734
arlas-aiasarlas-stackVerified publisher28.9.01 of 22See more

arlas-aias arlas-stack 28.9.0

1 of the 22 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
virtualenv@20.28.0
21.7.12

Open the chart page →

45,896
keystonearzu0.2.292 of 4See more

keystone arzu 0.2.29

2 of the 4 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
virtualenv@20.7.2
21.7.12
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
virtualenv@20.7.2
21.7.12

Open the chart page →

24,529
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
virtualenv@20.25.0
21.7.12

Open the chart page →

10,664
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
virtualenv@20.12.0
21.7.12

Open the chart page →

5,778
mealiebdclark-helm-chartsVerified publisher0.1.151 of 1See more

mealie bdclark-helm-charts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
virtualenv@21.7.5
21.7.12

Open the chart page →

5,083
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
virtualenv@20.4.7
21.7.12

Open the chart page →

88,028

Container images carrying it

175 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
virtualenv@20.35.4
21.7.12
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
virtualenv@20.26.1
21.7.12
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
virtualenv@20.36.1
21.7.12
1
ghcr.io/music-assistant/server:2.10.3885872224fa5
virtualenv@21.7.9
21.7.12
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
virtualenv@21.3.1
21.7.12
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
virtualenv@20.29.1
21.7.12
1
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
virtualenv@21.7.0
21.7.12
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
virtualenv@20.27.1
21.7.12
1
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
virtualenv@20.25.0
21.7.12
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
virtualenv@20.39.1
21.7.12
1
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
virtualenv@20.35.4
21.7.12
1
quay.io/kiali/kiali-operator:v2.32.096c5264d54ab
virtualenv@20.29.3
21.7.12
1
quay.io/kubev2v/forklift-operator:release-2.1200312252b07e
virtualenv@21.7.0
21.7.12
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
virtualenv@20.35.4
21.7.12
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.