BREW-CLOUDISCOVERY-CVE-2… (PYSEC-2026-4013)

Vulnerability from osv_homebrew – Published: 2026-09-30 21:05 – Updated: 2026-09-30 21:05 – Source website
VLAI
Summary
virtualenv bash and fish activation scripts execute commands embedded in paths
Details

The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.

activate is affected through the virtual environment's own path, on the branch that reports a relocated environment (Virtual environment directory __VIRTUAL_ENV__ does not exist!). For a destination named x'$(id)'y, shlex.quote emits 'x'"'"'$(id)'"'"'y'; the inner " closes the enclosing double quote and $(id) is left unquoted. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.

activate.fish is affected through the interpreter's Tcl/Tk library paths (set -gx TCL_LIBRARY '__TCL_LIBRARY__'). The rendered line becomes ''/tcl/(cmd)/lib'', and fish expands the (cmd) left between the adjacent quoted runs. The same doubling splits a path containing a space into two list elements, corrupting TCL_LIBRARY and TK_LIBRARY.

This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered activate.bat.

Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting shlex.quote applied.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@20.31.2",
        "upstream_fixed_in": "21.7.13"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "cloudiscovery",
        "purl": "pkg:brew/cloudiscovery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.4_4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@20.31.2",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "20.31.2"
      }
    ]
  },
  "details": "The generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a\n`shlex.quote`-ed value into a position that quotes it a second time. The extra\nquotes terminate the quoted run early and leave part of the value parsed as\nshell code, so a path containing shell metacharacters runs commands when a user\nsources the activation script.\n\n`activate` is affected through the virtual environment\u0027s own path, on the branch\nthat reports a relocated environment (`Virtual environment directory\n__VIRTUAL_ENV__ does not exist!`). For a destination named `x\u0027$(id)\u0027y`,\n`shlex.quote` emits `\u0027x\u0027\"\u0027\"\u0027$(id)\u0027\"\u0027\"\u0027y\u0027`; the inner `\"` closes the enclosing\ndouble quote and `$(id)` is left unquoted. This branch runs whenever the\nrecorded path is absent, which is the normal case for a virtual environment\ncopied or distributed to another machine.\n\n`activate.fish` is affected through the interpreter\u0027s Tcl/Tk library paths\n(`set -gx TCL_LIBRARY \u0027__TCL_LIBRARY__\u0027`). The rendered line becomes\n`\u0027\u0027/tcl/(cmd)/lib\u0027\u0027`, and fish expands the `(cmd)` left between the adjacent\nquoted runs. The same doubling splits a path containing a space into two list\nelements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.\n\nThis is the same defect class as GHSA-x78j-v8h9-3j2q, which covered\n`activate.bat`.\n\nFixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so\neach value keeps only the quoting `shlex.quote` applied.\n",
  "id": "BREW-cloudiscovery-CVE-2026-102925",
  "modified": "2026-09-30T21:05:15Z",
  "published": "2026-09-30T21:05:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3252"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.7.13"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/virtualenv"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv bash and fish activation scripts execute commands embedded in paths",
  "upstream": [
    "PYSEC-2026-4013",
    "CVE-2026-102925",
    "GHSA-p58f-9548-mpm2"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.