3672 matches found
virtualenv bash activate runs commands from an environment name with a backslash before $
Summary The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the user's shell each time bash draws the prompt. Affected area...
EUVD-2026-105273
virtualenv bash activate runs commands from an environment name with a backslash before $...
EUVD-2026-106869
virtualenv activate runs commands from the environment name in zsh with PROMPTSUBST...
EUVD-2026-106868
virtualenv activation scripts run code from a path that contains a placeholder name...
Exploit for CVE-2026-109618
PHP Security Check A read-only Bash-based inventory tool for...
Rocky Linux 9 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_84594)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202684594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable has...
RockyLinux 10 : environment-modules (RLSA-2026:80664)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable...
RHEL 10 : environment-modules (RHSA-2026:80664)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:80664 advisory. The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the VIRTUALENVPROMPT variable in src/virtualenv/activation/bash/activate.sh. When a virtual environment is activated in bash or zsh, the prompt string is interpolated into PS1 without fully...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script src/virtualenv/activation/bash/activate.sh. Bash processes PS1 in two passes each time it draws the prompt: it first decodes backsla...
AZL-110106 CVE-2026-113776 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
DEBIAN-CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
DEBIAN-CVE-2026-113726
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
AZL-110076 CVE-2026-113726 affecting package python-pip 24.2-10
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
AZL-110100 CVE-2026-113726 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
CVE-2026-113726
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
CVE-2026-113726
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
CVE-2026-113726
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
CVE-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...