PyPI / virtualenv / 21.14.8

virtualenv 21.14.8

Source

https://github.com/pypa/virtualenv

Tag scanned

21.14.8

Compared with

21.14.7 (2 signals introduced since)

Files

208 scanned, 33 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 14 info

Scan time

9.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-16 01:55

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info unicode-homoglyph tests/conftest.py:310:47 new in this release

   identifier `èрт` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

       # in PowerShell paths
       base = "'\";&&e-$ !%`|>__VIRTUAL_NAME__[1]èрт🚒♞中片-j"
       if IS_WIN:
           # NTFS path components cannot contain any of these, regardless of where they sit in the string

2. info unicode-mixed-script tests/conftest.py:310:47 new in this release

   identifier `èрт` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

       # in PowerShell paths
       base = "'\";&&e-$ !%`|>__VIRTUAL_NAME__[1]èрт🚒♞中片-j"
       if IS_WIN:
           # NTFS path components cannot contain any of these, regardless of where they sit in the string

3. info critical → info by review dynamic-import docs/render_cli.py:40:34

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

           module_name, attr_name = self.options["module"], self.options["func"]
           parser_creator = getattr(__import__(module_name, fromlist=[attr_name]), attr_name)
           core_result = parse_parser(parser_creator())

   likely benign LLM, confidence 0.80 Documentation tool that dynamically imports a module named in its directive options to render CLI docs.

   Reasoning

   This is a documentation-rendering helper that imports a module named in its directive options (module and func) and calls the function to build a parser for docs. Dynamic import is the expected behavior of a sphinx-style CLI doc extension. The module name comes from the documentation author's own configuration, not from untrusted input, so the risk is low.

4. info critical → info by review dynamic-import docs/render_cli.py:236:20

   `__import__` called on a non-literal expression (ast pass, confidence 0.70)

       of_class = of_type.split(".")
       data = getattr(__import__(".".join(of_class[:-1]), fromlist=[of_class[-1]]), of_class[-1])
       return [n.literal("", text=",".join(data))], []

   likely benign LLM, confidence 0.80 Resolves a dotted class path from documentation text via __import__ to render a type reference.

   Reasoning

   The __import__ call builds the module path by splitting a documented type string such as 'pkg.mod.Class' from the docs. It is the same doc-rendering pattern as the other finding in this file, and the input is authored documentation, not attacker-controlled runtime data.

5. info warn → info by review dynamic-execution docs/tutorial/getting-started.rst:102:21

   [embedded bash] command name is a variable (`$which`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

           (myproject) $ which python
           /home/user/myproject/bin/python

   dismissed LLM, confidence 0.85 Tutorial shell transcript showing 'which python' output in a venv.

   Reasoning

   This is an RST tutorial showing a shell prompt '(myproject) $ which python'. The '$which' is a prompt rendering artifact, not a variable-driven command in executable code. It is documentation text.

6. info critical → info by review path-command-shadow docs/tutorial/getting-started.rst:109:23

   [embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)

           (myproject) PS> where.exe python
           C:\Users\user\myproject\Scripts\python.exe

   dismissed LLM, confidence 0.85 Windows tutorial transcript showing where.exe output for the venv python.

   Reasoning

   The snippet is Windows tutorial output from 'where.exe python' showing the venv python path. The 'redirect to python' is a misreading of the prompt and output text. This is a doc example with no real redirect or PATH manipulation.

7. info warn → info by review obfuscated-command-name docs/tutorial/getting-started.rst:110:9

   [embedded bash] command name contains 5 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

           (myproject) PS> where.exe python
           C:\Users\user\myproject\Scripts\python.exe

   dismissed LLM, confidence 0.85 Windows path separators in tutorial example output were flagged as command obfuscation.

   Reasoning

   The 'backslash-escape' flag comes from ordinary Windows path separators in 'C:\Users\...\Scripts\python.exe' within a doc example. This is not command obfuscation.

8. info warn → info by review obfuscated-command-name docs/tutorial/getting-started.rst:117:9

   [embedded bash] command name contains 5 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

           (myproject) C:\> where.exe python
           C:\Users\user\myproject\Scripts\python.exe

   dismissed LLM, confidence 0.85 Windows where.exe example output in a tutorial, flagged for backslash paths.

   Reasoning

   Same pattern as the other flagged where.exe example: Windows backslash paths in documentation output triggered an obfuscation heuristic. Benign.

9. info warn → info by review dynamic-execution docs/tutorial/getting-started.rst:127:17

   [embedded bash] command name is a variable (`$pip`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

       (myproject) $ pip install requests
       Collecting requests
         Using cached requests-2.32.3-py3-none-any.whl (64 kB)

   dismissed LLM, confidence 0.85 Tutorial transcript showing a pip install command at a venv prompt.

   Reasoning

   '$pip install requests' is a shell prompt in a tutorial transcript. The variable-looking token is part of the displayed prompt and does not run in any executable context.

10. info warn → info by review dynamic-execution docs/tutorial/getting-started.rst:137:17

    [embedded bash] command name is a variable (`$python`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

        (myproject) $ python -c "import requests; print(requests.__file__)"
        /home/user/myproject/lib/python3.13/site-packages/requests/__init__.py

    dismissed LLM, confidence 0.85 Tutorial prompt line running python to print the requests package path.

    Reasoning

    '$python -c ...' is a documented prompt line showing how to check the requests install location. This is standard tutorial content, not a dynamic execution risk.

11. info warn → info by review obfuscated-command-name docs/tutorial/getting-started.rst:176:9

    [embedded bash] command name contains 3 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

            PS> .\myproject\Scripts\python.exe -c "import sys; print(sys.prefix)"
            C:\Users\user\myproject
    
            PS> .\myproject\Scripts\pip.exe install httpx

    dismissed LLM, confidence 0.85 PowerShell tutorial invoking the venv python via a relative Windows path.

    Reasoning

    '.\myproject\Scripts\python.exe' is a relative Windows path to the venv interpreter in a PowerShell tutorial. Backslashes are path separators, not obfuscation.

12. info warn → info by review obfuscated-command-name docs/tutorial/getting-started.rst:185:9

    [embedded bash] command name contains 3 backslash-escape sequences — hiding the true command (ast pass, confidence 0.85)

            C:\> .\myproject\Scripts\python.exe -c "import sys; print(sys.prefix)"
            C:\Users\user\myproject
    
            C:\> .\myproject\Scripts\pip.exe install httpx

    dismissed LLM, confidence 0.85 Command prompt tutorial invoking the venv python via a relative Windows path.

    Reasoning

    Same as the other Windows relative-path example. The backslash heuristic misfired on normal path separators in documentation.

13. info unicode-homoglyph tests/unit/activation/test_batch.py:26:21

    identifier `èрт` contains homoglyph candidates: р (0440)→p (in string/comment) (raw pass, confidence 0.35)

        """Exclude ampersands, which batch activation does not support in paths."""
        base = "'\";e-$ èрт🚒♞中片-j"
        if IS_WIN:
            base = base.replace('"', "").replace(";", "")

14. info unicode-mixed-script tests/unit/activation/test_batch.py:26:21

    identifier `èрт` mixes scripts: Latin + Cyrillic (in string/comment) (raw pass, confidence 0.40)

        """Exclude ampersands, which batch activation does not support in paths."""
        base = "'\";e-$ èрт🚒♞中片-j"
        if IS_WIN:
            base = base.replace('"', "").replace(";", "")

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/pypa/virtualenv virtualenv && cd virtualenv
git checkout 21.14.8
disclude scan --severity info --diff 21.14.7 .