virtualenv allows command injection through activation scripts for a virtual environment

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-53899 · ADVISORY
• pypa/virtualenv · WEB
• pypa/virtualenv#2771 · WEB
• pypa/advisory-database · WEB
• pypa/virtualenv · PACKAGE
• pypa/virtualenv release 20.26.6 · WEB
• GitHub Advisory GHSA-rqc4-2hc7-8c8v · ADVISORY

Weitere Schwachstellen in virtualenv

• CVE-2026-115586HOCH 7.1virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy a…
• CVE-2026-113776HOCH 7.8virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_templat…
• CVE-2026-113732HOCH 7.8virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(…
• CVE-2026-113726HOCH 7.8virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources lea…
• CVE-2026-113725HOCH 7.8virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment n…