https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 15:22:08 +0000 https://db.gcve.eu/vuln/bit-virtualenv-2026-113723 <p><strong>Affected:</strong> Bitnami: virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.</p> <p><strong>Affected:</strong> Bitnami: virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.</p> https://db.gcve.eu/vuln/bit-virtualenv-2026-113723 https://db.gcve.eu/vuln/cve-2026-113723 <p><strong>Affected:</strong> pypa virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.</p> <p><strong>Affected:</strong> pypa virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.</p> https://db.gcve.eu/vuln/cve-2026-113723 https://db.gcve.eu/vuln/ghsa-6w3r-xr62-4xcp <p><strong>Affected:</strong> PyPI: virtualenv</p> <p>## Summary</p> <p>Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.</p> <p>## Affected area</p> <p>Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does not establish exposure through unrelated activators.</p> <p>## Attacker-controlled input</p> <p>The attacker controls prompt or destination data passed as a virtualenv argument. The user later sources the generated activation script.</p> <p>## Affected code</p> <p>The relevant 21.14.8 source is in [bash prompt assembly](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/bash/activate.sh).</p> <p>## Mechanism</p> <p>`bin/activate` copies the prompt into `PS1`. A shell expands `PS1` again when it draws a prompt, so the value must survive both the assignment and that later expansion. The bash and zsh branches escape for their usual prompt rules. Three other paths still interpret prompt data as commands: dash sourcing `activate` directly, a child dash inheriting an exported `PS1` from bash, and bash running at compatibility level 4.2 or lower. A value such as `x$(touch MARKER)y` then runs `touch` on prompt display. Creating the environment does not run the payload.</p> <p>##…</p> <p><strong>Affected:</strong> PyPI: virtualenv</p> <p>## Summary</p> <p>Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.</p> <p>## Affected area</p> <p>Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does not establish exposure through unrelated activators.</p> <p>## Attacker-controlled input</p> <p>The attacker controls prompt or destination data passed as a virtualenv argument. The user later sources the generated activation script.</p> <p>## Affected code</p> <p>The relevant 21.14.8 source is in [bash prompt assembly](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/activation/bash/activate.sh).</p> <p>## Mechanism</p> <p>`bin/activate` copies the prompt into `PS1`. A shell expands `PS1` again when it draws a prompt, so the value must survive both the assignment and that later expansion. The bash and zsh branches escape for their usual prompt rules. Three other paths still interpret prompt data as commands: dash sourcing `activate` directly, a child dash inheriting an exported `PS1` from bash, and bash running at compatibility level 4.2 or lower. A value such as `x$(touch MARKER)y` then runs `touch` on prompt display. Creating the environment does not run the payload.</p> <p>##…</p> https://db.gcve.eu/vuln/ghsa-6w3r-xr62-4xcp