PT-2026-120138

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.4 Description The bash activate script, which is also sourced by zsh, fails to properly escape the environment name. In versions prior to 21.13.0, the name remains unescaped. In versions 21.13.0 through...

Python Packaging Authority virtualenv command injection vulnerability

The Python Packaging Authority’s virtualenv version 20.26.6 to 21.14.2 contains a security vulnerability. This vulnerability stems from ViaTemplateActivator.instantiatetemplate, which replaces placeholders in the activation template on a per-key basis. As a result, names such as VIRTUALNAME,...

Python Packaging Authority virtualenv command injection vulnerability

The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a command injection vulnerability. This vulnerability arises from the prompt text provided by the caller potentially becoming executable syntax in the bash activation prompt, which can lead to command injection...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.7. This vulnerability stems from incomplete escaping of environment variables in the bash activate script; backslashes can be unescaped, allowing commands to be executed in the user’s shell when names...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.4. This vulnerability stems from improper escaping of environment names in the bash activate script. When PROMPTSUBST is enabled in zsh, values such as environment directories, --prompt, or...

Moderate: Red Hat Security Advisory: environment-modules security update

An update for environment-modules is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

environment-modules security update

5.3.0-2.1 - fix command injection in bash Tab completion CVE-2026-85013...

ALSA-2026:84594 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

Oracle Linux 9 : environment-modules (ELSA-2026-84594)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-84594 advisory. 5.3.0-2.1 - fix command injection in bash Tab completion CVE-2026-85013 Tenable has extracted the preceding description block directly from the Oracle Linux...

RHEL 9 : environment-modules (RHSA-2026:84594)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84594 advisory. The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information need...

AlmaLinux 9 : environment-modules (ALSA-2026:84594)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:84594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable ha...

Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

GNU Bash 4.3 Remote Command Execution

GNU Bash versions through 4.3 contain a flaw that allows crafted environment variables passed to CGI scripts to execute commands. This proof of concept sends a malicious User-Agent header to demonstrate the issue. https://packetstorm.news/download/236107...

Exploit for OS Command Injection in Gnu Bash

CVE-2014-6271 Shellshock xpl0ited by infrar3dhttps://githu...

PT-2026-118629

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description Caller-supplied prompt text can be converted into executable syntax within the bash activation prompt. This occurs when an attacker influences the value passed to the tool, and a user subsequent...

Rocky Linux 8 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_82919)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682919 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable has...

PT-2026-115919

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

Ollama 0.31.1 Bash Approval Bypass

Ollama version 0.31.1 experimental Agent Mode contains an incorrect authorization flaw that permits appended shell commands to reuse an approved command prefix. The proof of concept exercises the vulnerable approval logic without executing commands. https://packetstorm.news/download/236043...

MiracleLinux 8 : environment-modules-4.5.2-5.el8_10 (AXSA:2026-2078:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2078:01 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenab...