StackRadar

CVE-2026-102937

High

Advisory

Published 18 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.3
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
140
of 18,026 indexed, latest versions
Container images
175
deployed by those charts
Fix available
1 of 2
affected packages

virtualenv: Command injection via --prompt in activate.bat (batch activator)

Carried by container images the latest versions of 140 of 18,026 indexed charts deploy, on 175 images.

Affected packageAffected versionsFixed inImages
virtualenvpypi1.11.4, 15.1.0, 16.3.0, 16.6.0+58 more21.7.12175
python-virtualenvdeb1.11.4-1ubuntu1, 20.0.17-1ubuntu0.3, 20.17.1+ds-1, 20.25.0+ds-2+1 moreno fix listed10
OSV records
DEBIAN-CVE-2026-102937GHSA-x78j-v8h9-3j2qUBUNTU-CVE-2026-102937
Also known as
PYSEC-2026-4014

Charts affected

140 by stars
ChartLatestAffected imagesRadar Score
couchpotatobryanalves0.3.01 of 1See more

couchpotato bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
linuxserver/couchpotato:75e576ee-ls32c4d2766b9eb7
virtualenv@16.7.9
21.7.12

Open the chart page →

2,084
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
virtualenv@16.7.9
21.7.12

Open the chart page →

2,715
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
virtualenv@20.21.1
21.7.12

Open the chart page →

3,043
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
virtualenv@21.6.1
21.7.12

Open the chart page →

1,522
kube-ops-viewchristianhuthVerified publisher8.3.31 of 1See more

kube-ops-view christianhuth 8.3.3

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
virtualenv@20.21.1
21.7.12

Open the chart page →

1,455
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
python-virtualenv@1.11.4-1ubuntu1
virtualenv@1.11.4
no fix listed
21.7.12
galaxy/galaxy-stable:v18.018e577a626dfd
python-virtualenv@1.11.4-1ubuntu1
virtualenv@1.11.4
no fix listed
21.7.12

Open the chart page →

169,853
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
python-virtualenv@20.17.1+ds-1
virtualenv@20.17.1+ds
no fix listed
21.7.12

Open the chart page →

7,132
metaflowcluster-deploy0.2.21 of 1See more

metaflow cluster-deploy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
virtualenv@20.27.1
21.7.12

Open the chart page →

9,240
couchpotatocronce0.0.11 of 1See more

couchpotato cronce 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
linuxserver/couchpotato:75e576ee-ls389cd8d5fb1ac
virtualenv@16.3.0
21.7.12

Open the chart page →

3,936
csghubcsghubVerified publisher2.5.01 of 34See more

csghub csghub 2.5.0

1 of the 34 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
virtualenv@20.32.0
21.7.12

Open the chart page →

58,956
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
virtualenv@20.24.7
21.7.12

Open the chart page →

7,395
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
virtualenv@20.29.3
21.7.12

Open the chart page →

5,767
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
virtualenv@20.35.4
21.7.12
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
virtualenv@20.35.4
21.7.12
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
virtualenv@20.35.4
21.7.12
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
virtualenv@20.35.4
21.7.12
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
virtualenv@20.35.4
21.7.12
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
virtualenv@20.35.4
21.7.12
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
virtualenv@20.35.4
21.7.12

Open the chart page →

12,853
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
virtualenv@20.27.1
21.7.12

Open the chart page →

10,735
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
virtualenv@20.27.1
21.7.12

Open the chart page →

10,735
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
virtualenv@20.29.2
21.7.12

Open the chart page →

56,689
autonodelabeldjjudas21Verified publisher0.0.101 of 1See more

autonodelabel djjudas21 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
djjudas21/autonodelabel:0.0.6f17233350c4f
virtualenv@20.24.2
21.7.12

Open the chart page →

1,405
codecovdoubanVerified publisher0.2.42 of 8See more

codecov douban 0.2.4

2 of the 8 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
virtualenv@20.4.3
21.7.12
codecov/self-hosted-worker:24.4.1837f546b479b
virtualenv@20.24.5
21.7.12

Open the chart page →

27,417
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
virtualenv@21.7.4
21.7.12

Open the chart page →

3,056
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
virtualenv@20.17.1
21.7.12

Open the chart page →

5,300
kodiakfikaworks1.1.41 of 2See more

kodiak fikaworks 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
cdignam/kodiak:v0.54.05a6a55b39cee
virtualenv@20.15.1
21.7.12

Open the chart page →

5,773
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
virtualenv@21.3.3
21.7.12

Open the chart page →

118,558
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
virtualenv@20.30.0
21.7.12

Open the chart page →

14,391
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
virtualenv@20.35.4
21.7.12

Open the chart page →

10,718
hawk-envoy-pluginhawk0.1.01 of 4See more

hawk-envoy-plugin hawk 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
kong/httpbin:latesta6ac46531193
virtualenv@20.28.1
21.7.12

Open the chart page →

70,994
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
virtualenv@20.29.2
21.7.12

Open the chart page →

5,583
kube-downscalerhelm-charts-nr0.7.61 of 1See more

kube-downscaler helm-charts-nr 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
virtualenv@20.23.1
21.7.12

Open the chart page →

4,643
homeassistanthomeenterpriseinc0.3.01 of 1See more

homeassistant homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2022.3.5565751f33794
virtualenv@20.13.3
21.7.12

Open the chart page →

8,924
httpbin2022httpbin2022Verified publisher0.1.11 of 1See more

httpbin2022 httpbin2022 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
mshanley80/httpbin2022:latest5b189a70c0fb
virtualenv@20.17.1
21.7.12

Open the chart page →

76,997
ibm-kerify-devibm-charts1.0.01 of 1See more

ibm-kerify-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
virtualenv@16.6.0
21.7.12

Open the chart page →

8,348
twitch-channel-points-minerjacobcolvinVerified publisher0.1.01 of 1See more

twitch-channel-points-miner jacobcolvin 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
virtualenv@20.24.3
21.7.12

Open the chart page →

1,284
shynetjuniorjpdj0.1.321 of 1See more

shynet juniorjpdj 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
virtualenv@20.21.1
21.7.12

Open the chart page →

2,865
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
virtualenv@21.3.1
21.7.12

Open the chart page →

8,181
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
virtualenv@20.16.5
21.7.12

Open the chart page →

84,883
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
virtualenv@20.24.5
21.7.12

Open the chart page →

7,663
apikrateo1.0.31 of 1See more

api krateo 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/api:1.0.3edbaa031754d
virtualenv@20.16.3
21.7.12

Open the chart page →

5,253
argocd-servicekrateo1.0.71 of 1See more

argocd-service krateo 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/argocd-service:1.0.749b727854938
virtualenv@20.16.6
21.7.12

Open the chart page →

5,222
auth-servicekrateo1.2.361 of 1See more

auth-service krateo 1.2.36

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/auth-service:1.2.36794bc5877f76
virtualenv@20.24.6
21.7.12

Open the chart page →

5,612
capi-servicekrateo1.1.91 of 1See more

capi-service krateo 1.1.9

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/capi-service:1.1.92eee721260eb
virtualenv@20.17.1
21.7.12

Open the chart page →

4,929
codequality-servicekrateo1.1.11 of 1See more

codequality-service krateo 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/codequality-service:1.1.19a9a77b01eb1
virtualenv@20.16.6
21.7.12

Open the chart page →

4,805
component-servicekrateo0.2.11 of 1See more

component-service krateo 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/component-service:0.2.14a5f506c0560
virtualenv@20.16.6
21.7.12

Open the chart page →

5,140
deployment-servicekrateo1.2.591 of 1See more

deployment-service krateo 1.2.59

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/deployment-service:1.2.59da9f93f2f731
virtualenv@20.25.1
21.7.12

Open the chart page →

10,241
endpoint-servicekrateo1.0.11 of 1See more

endpoint-service krateo 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/endpoint-service:1.0.16c3777c042f7
virtualenv@20.15.1
21.7.12

Open the chart page →

5,871
event-servicekrateo1.1.61 of 1See more

event-service krateo 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/event-service:1.1.671fd074020f4
virtualenv@20.16.6
21.7.12

Open the chart page →

5,259
git-servicekrateo1.0.131 of 1See more

git-service krateo 1.0.13

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/git-service:1.0.13c22f183fedf0
virtualenv@20.23.1
21.7.12

Open the chart page →

6,198
keptn-servicekrateo1.0.121 of 1See more

keptn-service krateo 1.0.12

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/keptn-service:1.0.12f9fef2435636
virtualenv@20.24.6
21.7.12

Open the chart page →

5,313
keptn-service-insielkrateo0.1.31 of 1See more

keptn-service-insiel krateo 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/keptn-service-insiel:0.1.3c1d475bb7f06
virtualenv@20.16.3
21.7.12

Open the chart page →

5,166
krateo-remote-clientkrateo0.4.161 of 1See more

krateo-remote-client krateo 0.4.16

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/krateo-remote-client:0.4.167ccd4382f3fa
virtualenv@20.24.5
21.7.12

Open the chart page →

5,384
krateo-remote-serverkrateo0.2.41 of 1See more

krateo-remote-server krateo 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/krateo-remote-server:0.2.40df58c99cc6f
virtualenv@20.24.3
21.7.12

Open the chart page →

5,541
kubernetes-servicekrateo1.1.11 of 1See more

kubernetes-service krateo 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-102937.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/kubernetes-service:1.1.1974fbc0d93ed
virtualenv@20.16.6
21.7.12

Open the chart page →

5,197

Container images carrying it

175 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
virtualenv@20.35.4
21.7.12
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
virtualenv@20.26.1
21.7.12
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
virtualenv@20.36.1
21.7.12
1
ghcr.io/music-assistant/server:2.10.3885872224fa5
virtualenv@21.7.9
21.7.12
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
virtualenv@21.3.1
21.7.12
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
python-virtualenv@20.25.0+ds-2
virtualenv@20.25.0+ds
no fix listed
21.7.12
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
virtualenv@20.29.1
21.7.12
1
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
virtualenv@21.7.0
21.7.12
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
virtualenv@20.27.1
21.7.12
1
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
virtualenv@20.25.0
21.7.12
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
virtualenv@20.39.1
21.7.12
1
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
virtualenv@20.35.4
21.7.12
1
quay.io/kiali/kiali-operator:v2.32.096c5264d54ab
virtualenv@20.29.3
21.7.12
1
quay.io/kubev2v/forklift-operator:release-2.1200312252b07e
virtualenv@21.7.0
21.7.12
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
virtualenv@20.35.4
21.7.12
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
virtualenv@20.35.4
21.7.12
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.