Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script src/virtualenv/activation/bash/activate.sh. Bash processes PS1 in two passes on every prompt redraw: it first decodes backslash prom...

CVE-2026-113725

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

CVE-2026-113725

The virtualenv tool, used for creating isolated Python environments, is vulnerable to command injection in versions prior to 21.14.7 . The root cause lies in the bash activate script , which fails to properly escape the environment name during one of the two passes bash makes over PS1 . Specifica...

CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113723

The virtualenv tool, used for creating isolated Python environments, is vulnerable to OS Command Injection (CWE-78) in versions prior to 21.14.9 . The root cause is that caller-supplied prompt text can be interpreted as executable syntax within the bash activation prompt when using older compatib...

CVE-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

RLSA-2026:84594 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

environment-modules security update

An update is available for environment-modules. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The environment-modules packages provide dynamic modification of...

CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

CVE-2026-109440

LangAlpha versions through 2026.09.07 are susceptible to an indirect prompt injection vulnerability. This flaw allows remote attackers to execute shell commands or Python code by embedding malicious instructions within web content retrieved by the agent. The vulnerability exists because the Bash ...

CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

MiracleLinux 9 : environment-modules-5.3.0-2.el9_8.1 (AXSA:2026-2099:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2099:02 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenab...

RockyLinux 9 : environment-modules (RLSA-2026:84594)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:84594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable h...

PT-2026-120140

Name of the Vulnerable Software and Affected Versions virtualenv versions 20.26.6 through 21.14.1 Description The ViaTemplateActivator.instantiate template function replaces placeholders sequentially across the activation template. This allows trigger names like VIRTUAL NAME , VIRTUAL ENV , or...

PT-2026-120138

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.4 Description The bash activate script, which is also sourced by zsh, fails to properly escape the environment name. In versions prior to 21.13.0, the name remains unescaped. In versions 21.13.0 through...

PT-2026-118631

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.7 Description The bash activate script fails to properly escape the environment name during the two passes bash performs over the PS1 prompt variable. Consequently, a backslash in the environment name can und...