Affected: Homebrew: cloudiscovery

`BatchActivator.quote()` returned its input unchanged, the only activator with no escaping at all. `--prompt`, the `VIRTUALENV_PROMPT` environment variable, and the config file all set the prompt, and `activate.bat` writes it straight into `@set "VAR=value"`. A prompt containing a double quote closes that string early, and whatever follows runs as live cmd.exe syntax. For example, a venv created with `--prompt 'x" & calc & "'` runs `calc` the moment someone runs `activate.bat`.

Anyone who templates a prompt from untrusted input (a CI job using a branch name, a wrapper script deriving an environment name from user input) hands an attacker code execution in the shell of anyone who activates the resulting venv on Windows.

Fixed in 21.7.12 by escaping the characters cmd.exe treats as live syntax inside this construct.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.

Affected: PyPI: virtualenv

`BatchActivator.quote()` returned its input unchanged, the only activator with no escaping at all. `--prompt`, the `VIRTUALENV_PROMPT` environment variable, and the config file all set the prompt, and `activate.bat` writes it straight into `@set "VAR=value"`. A prompt containing a double quote closes that string early, and whatever follows runs as live cmd.exe syntax. For example, a venv created with `--prompt 'x" & calc & "'` runs `calc` the moment someone runs `activate.bat`.

Anyone who templates a prompt from untrusted input (a CI job using a branch name, a wrapper script deriving an environment name from user input) hands an attacker code execution in the shell of anyone who activates the resulting venv on Windows.

Fixed in 21.7.12 by escaping the characters cmd.exe treats as live syntax inside this construct.

Affected: Ubuntu:14.04:LTS: python-virtualenv, Ubuntu:16.04:LTS: python-virtualenv, Ubuntu:18.04:LTS: python-virtualenv, Ubuntu:Pro:20.04:LTS: python-virtualenv, Ubuntu:Pro:22.04:LTS: python-virtualenv, Ubuntu:Pro:24.04:LTS: python-virtualenv, Ubuntu:26.04:LTS: python-virtualenv

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.