https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 13:38:36 +0000 https://db.gcve.eu/vuln/cve-2026-102937 <p><strong>Affected:</strong> pypa virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set &#34;VAR=value&#34; statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user&#39;s privileges. This issue is fixed in version 21.7.12.</p> <p><strong>Affected:</strong> pypa virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set &#34;VAR=value&#34; statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user&#39;s privileges. This issue is fixed in version 21.7.12.</p> https://db.gcve.eu/vuln/cve-2026-102937 https://db.gcve.eu/vuln/pysec-2026-4014 <p><strong>Affected:</strong> PyPI: virtualenv</p> <p>`BatchActivator.quote()` returned its input unchanged, the only activator with no escaping at all. `--prompt`, the `VIRTUALENV_PROMPT` environment variable, and the config file all set the prompt, and `activate.bat` writes it straight into `@set &#34;VAR=value&#34;`. A prompt containing a double quote closes that string early, and whatever follows runs as live cmd.exe syntax. For example, a venv created with `--prompt &#39;x&#34; &amp; calc &amp; &#34;&#39;` runs `calc` the moment someone runs `activate.bat`.</p> <p>Anyone who templates a prompt from untrusted input (a CI job using a branch name, a wrapper script deriving an environment name from user input) hands an attacker code execution in the shell of anyone who activates the resulting venv on Windows.</p> <p>Fixed in 21.7.12 by escaping the characters cmd.exe treats as live syntax inside this construct.</p> <p><strong>Affected:</strong> PyPI: virtualenv</p> <p>`BatchActivator.quote()` returned its input unchanged, the only activator with no escaping at all. `--prompt`, the `VIRTUALENV_PROMPT` environment variable, and the config file all set the prompt, and `activate.bat` writes it straight into `@set &#34;VAR=value&#34;`. A prompt containing a double quote closes that string early, and whatever follows runs as live cmd.exe syntax. For example, a venv created with `--prompt &#39;x&#34; &amp; calc &amp; &#34;&#39;` runs `calc` the moment someone runs `activate.bat`.</p> <p>Anyone who templates a prompt from untrusted input (a CI job using a branch name, a wrapper script deriving an environment name from user input) hands an attacker code execution in the shell of anyone who activates the resulting venv on Windows.</p> <p>Fixed in 21.7.12 by escaping the characters cmd.exe treats as live syntax inside this construct.</p> https://db.gcve.eu/vuln/pysec-2026-4014