561 matches found
AntiOreans-CodeDevirtualizer
AntiOreans-CodeDevirtualizer Introduction A proof-of-concept devirtualization engine for Themida, written as part of my Master's Thesis. The engine is written as a plugin for IDA 6.8, and only supports early versions of the FISH virtual machine architecture 2.2.5.0, 2.2.6.0, 2.2.7.0. The source...
BIT-VIRTUALENV-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
PT-2026-132504
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate template replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUAL NAME , VIRTUAL ENV , or VIRTUAL PROMPT...
SUSE CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
Linux Distros Unpatched Vulnerability : CVE-2026-113776
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholde...
CLSA-2026-1792629147 python-virtualenv: Fix of 3 CVEs
Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting - Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and...
CLSA-2026-1792629041 python-virtualenv: Fix of 4 CVEs
Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting - Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and...
Virtualenv Activate.fish Runs Commands From A Path Or Prompt With A Backslash Before A Quote
Impact "FishActivator" defines no "quote", so it inherits "ViaTemplateActivator.quote", which returns "shlex.quotestring". That function follows POSIX "sh" rules, where a backslash inside single quotes stays a literal character. fish reads "'" inside single quotes as an escaped quote and "\" as...
Virtualenv Activation Scripts Run Code From A Path That Contains A Placeholder Name
Impact "ViaTemplateActivator.instantiatetemplate" replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted...
EUVD-2026-106868
virtualenv activation scripts run code from a path that contains a placeholder name...
CVE-2026-113732
A flaw was found in virtualenv. The Fish shell activation script generator improperly sanitizes and quotes environment paths and prompt values. If an attacker can influence these values, specially crafted input can break out of the script's quoting syntax. Consequently, this flaw allows arbitrary...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via FishActivator, which inherits shlex.quote for escaping shell arguments. The POSIX quoting rules applied by shlex.quote leave backslash characters literal inside single quotes, but the fish shell treats ' as an...
DEBIAN-CVE-2026-113732
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
AZL-110091 CVE-2026-113732 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
AZL-110106 CVE-2026-113776 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
DEBIAN-CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113732
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...