[durgajagadeesh]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

• Address CVE-2026-102938, CVE-2026-113713, CVE-2026-113715, CVE-2026-113716, CVE-2026-113719, CVE-2026-113720, CVE-2026-113721, CVE-2026-113722, CVE-2026-113723, CVE-2026-113725, CVE-2026-113726, CVE-2026-113732, CVE-2026-113776, CVE-2026-115586.

Change Log

• Modified: ./SPECS/python-virtualenv/python-virtualenv.spec
• new file: CVE-2026-102938.patch
• new file: CVE-2026-113713.patch
• new file: CVE-2026-113715.patch
• new file: CVE-2026-113716.patch
• new file: CVE-2026-113719.patch
• new file: CVE-2026-113720.patch
• new file: CVE-2026-113721.patch
• new file: CVE-2026-113722.patch
• new file: CVE-2026-113723.patch
• new file: CVE-2026-113725.patch
• new file: CVE-2026-113726.patch
• new file: CVE-2026-113732.patch
• new file: CVE-2026-113776.patch
• new file: CVE-2026-115586.patch

Does this affect the toolchain?

NO

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-102938
• https://nvd.nist.gov/vuln/detail/CVE-2026-113713
• https://nvd.nist.gov/vuln/detail/CVE-2026-113715
• https://nvd.nist.gov/vuln/detail/CVE-2026-113716
• https://nvd.nist.gov/vuln/detail/CVE-2026-113719
• https://nvd.nist.gov/vuln/detail/CVE-2026-113720
• https://nvd.nist.gov/vuln/detail/CVE-2026-113721
• https://nvd.nist.gov/vuln/detail/CVE-2026-113722
• https://nvd.nist.gov/vuln/detail/CVE-2026-113723
• https://nvd.nist.gov/vuln/detail/CVE-2026-113725
• https://nvd.nist.gov/vuln/detail/CVE-2026-113726
• https://nvd.nist.gov/vuln/detail/CVE-2026-113732
• https://nvd.nist.gov/vuln/detail/CVE-2026-113776
• https://nvd.nist.gov/vuln/detail/CVE-2026-115586

Test Methodology

• Pipeline build id: xxxx
• Buddy build

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[durgajagadeesh]

• All patches are applying cleanly.
• Patch references from upstream are included in Patches.

Buddy Build

1. CVE-2026-102938.patch
   Backported: Yes.
   Patch backport change details:
   Reused the shared line-boundary sanitizer introduced by the earlier configuration backport instead of adding upstream’s duplicate private helper.
   Sanitized the formatted configuration line, preserving this version’s existing value formatting and path normalization.
   Retained the exclusive file-writing protection supplied by another backport.
   Converted upstream dependency groups and TOML tox environments into this version’s optional extras and INI tox configuration.
   Added Atheris instrumentation after verification showed the original driver produced no coverage feedback.
   Did not introduce the upstream CI job because the corresponding workflow is absent; CI changes were excluded from the requested scope.

2. CVE-2026-113713.patch
   Backported: Yes.
   Patch backport change details:
   Applied the change to the older app-data seeder and existing test-module layout.
   Adapted the typed upstream tests to the local test style and imports.
   No additional production-logic change beyond upstream. Preserving host environment variables in the tests comes from the upstream follow-up commit, not a custom Azure change.

3. CVE-2026-113715.patch
   Backported: Yes.
   Patch backport change details:
   Added the shared text-safety helper because it was not present in the older source.
   Retained the existing internal interpreter-discovery API instead of introducing upstream’s newer discovery dependency.
   Translated upstream’s GraalPy implementation identifier and system_exe attribute to this release’s GraalVM identifier and system_executable attribute.
   Adapted tests to the existing creator-selection interfaces.

4. CVE-2026-113716.patch
   Backported: Yes.
   Patch backport change details:
   Included the directory-containment helper and its export because upstream assumes that prerequisite is already available from another change.
   Integrated the checks into the older builtin and stdlib creator implementations.
   Expanded local regression coverage to include both internal/external link targets and executable, pure-library, and platform-library paths.
   Used the repository’s executable-lookup pattern for Windows junction tests.

5. CVE-2026-113719.patch
   Backported: Yes.
   Patch backport change details:
   Rebased the cleanup changes onto the older package installer and updated its existing caller to supply the environment destination.
   Preserved the console-launcher changes already applied by another CVE backport.
   Adapted annotations and test placement to the local source.
   No additional cleanup algorithm beyond the final upstream series.

6. CVE-2026-113720.patch
   Backported: Yes.
   Patch backport change details:
   Combined the final behavior of the four upstream commits into one CVE patch.
   Integrated the new copy helper into utilities that already contained the directory-link backport, preserving those checks and the older deletion implementation.
   Adapted function annotations and tests to the local style.
   The permission limits and 1 MiB buffer are upstream changes—not extra Azure-specific behavior.

7. CVE-2026-113721.patch
   Backported: Yes.
   Patch backport change details:
   Reused the directory-containment helper already introduced by CVE-2026-113716 rather than adding it again.
   Connected the exclusive writer to this version’s older text-writing paths while preserving activation-script encoding behavior.
   Preserved the older deletion helper and the permission constant it still requires.
   Removed the upstream test’s Python 3.9-only selection because this release generates the import hooks under the current interpreter too.
   Adapted Windows command lookup to the existing repository pattern.

8. CVE-2026-113722.patch
   Backported: Yes.
   Patch backport change details:
   Integrated launcher rewriting into the older pip-seeding execution flow.
   Retained this version’s installer interfaces and imports instead of transplanting newer upstream installer infrastructure.
   Adapted the upstream subprocess tests to the existing creator fixtures and interpreter-path conventions.
   The quoting algorithm, launcher selection, and file-record updates follow the final upstream series.

9. CVE-2026-113723.patch
   Backported: Yes.
   Patch backport change details:
   Applied the final prompt-handling logic directly to the older activation template, which lacks upstream’s newer surrounding layout and intermediate fixes.
   Used a literal backslash replacement variable for the non-expanding Bash branch to avoid compatibility-dependent quote removal.
   Adapted tests to locally generated activation scripts and interactive prompt rendering.
   Added coverage for Bash compatibility level 3.1 and additional shell-preservation cases.

10. CVE-2026-113725.patch
    Backported: Yes — regression coverage; production protection is already covered by CVE-2026-113723.
    Patch backport change details:
    Did not overwrite the newer deferred-expansion implementation with upstream’s older double-escaping implementation.
    Ported the upstream regression cases into the existing Bash/Zsh test harness and added the changelog.
    Incidental difference: The local patch also contains seven import-only additions unrelated to this CVE’s required fix.

11. CVE-2026-113726.patch
    Backported: Yes — regression coverage; production Zsh escaping is already covered by CVE-2026-113723.
    Patch backport change details:
    Preserved the already-integrated production escaping instead of applying an older overlapping source hunk.
    Adapted upstream’s cross-shell tests to the local activation-script fixture.
    Used interactive prompt rendering rather than relying on upstream’s shell-version-specific rendering commands.

12. CVE-2026-113732.patch
    Backported: Yes.
    Patch backport change details:
    Applied the Fish quoting change to the older activator and Tkinter test layout.
    Added the Path and cli_run imports and Fish executable lookup that upstream’s test module already had, but the older source lacked.
    These test-setup additions resolve the Azure package’s collection failure.
    The Fish quoting algorithm itself is unchanged from upstream.

13. CVE-2026-113776.patch
    Backported: Yes.
    Patch backport change details:
    Integrated single-pass substitution into the older shared template activator.
    Omitted upstream’s C-shell display-token-specific changes because those newer tokens and overrides do not exist in this release.
    Adapted the shared special-character fixture to its existing format.
    Corrected the local nested-path fixture to derive the environment name from the destination basename, matching actual creator behavior.

[durgajagadeesh]

Buddy Build

[durgajagadeesh]

Completed the peer review comment updates from Aditya.

CVE-2026-102938: Trimmed the backport to the configuration-writer fix and ordinary unit tests; removed optional property/fuzz infrastructure.
CVE-2026-113716: Corrected the squashed-patch header and referenced merged upstream commit 554d9f9d.
CVE-2026-113719: Corrected the patch header and referenced merged upstream commit e3cea6fa.
CVE-2026-113720: Restored dangling-symlink cleanup before exclusive copying, added regression tests, and referenced merged commit 35f0b335.
CVE-2026-113721: Rebased the patch against the preceding copy-cleanup and import changes while preserving generated-file protections.
CVE-2026-113723: Corrected the header, referenced merged commit 5f48d711, and documented the required CVE-2026-115586 follow-up.
CVE-2026-113725: Removed seven unused imports and clarified that this patch provides regression coverage, with production protection supplied by the other prompt patches.
CVE-2026-113726: Added a complete patch header, retained upstream reference 5b915367, and documented its regression-only scope and production-fix dependencies.
CVE-2026-113732: Aligned Fish test imports and executable detection with the validated source; moved adaptation details out of the RPM changelog.
CVE-2026-115586: Added the upstream prompt-state fix and regression tests, registered it as Patch1029, and updated the changelog while retaining Release 9.

Validation

• 18 source patches applied with zero fuzz to a clean, checksum-verified archive.
• Packaging-produced source matches the tested changes.
• 345 passed, 49 skipped, 4 slow tests deselected.
• Full package-test collection succeeded.
• RPM spec parsing, lint, formatting, shell syntax, and metadata checks passed.

Buddy build:

[azurelinux-ci-jwt-app]

Auto cherry-pick results:

• 3.0-dev ✅ -> [AUTO-CHERRYPICK] [High] python-virtualenv: security backports and dev test reconciliation - branch 3.0-dev #19830

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1240347&view=results