quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

zi

Zi Manage your Zsh plugins, snippets, and command-line tools. Quick start · Documentation · Releases · Discussions Zi is the Z-Shell ecosystem's plugin manager, formerly known as zplugin and zinit. Features Responsive startup: defer plugin loading until after the first prompt with Turbo mode...

qsreplace

qsreplace Accept URLs on stdin, replace all query string values with a user-supplied value, only output each combination of query string parameters once per host and path. Usage Example input file: ▶ cat urls.txt https://example.com/path?one=1&two=2 https://example.com/path?two=2&one=1...

CVE-2025-55616

CVE-2025-55616 Author: Rana M.Sinan Adil Vulnerability Found in Zsh leading RCE through History Expression Key Points To Run this exploit: just change the ip address and the "p system" in exploit , because i also tried this in my second laptop, and to change it run this following command in gdb...

SUSE CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

Linux Distros Unpatched Vulnerability : CVE-2026-113726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment...

CLSA-2026-1792629147 python-virtualenv: Fix of 3 CVEs

Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting - Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and...

CLSA-2026-1792629041 python-virtualenv: Fix of 4 CVEs

Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting - Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and...

Virtualenv Activate Runs Commands From The Environment Name In Zsh With PROMPT_SUBST

Impact zsh users activate an environment with the bash "activate" script, which puts the environment name into "PS1". Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when "BASHVERSION" is set, so zsh gets the raw value. With the "PROMPTSUBST" option...

EUVD-2026-106869

virtualenv activate runs commands from the environment name in zsh with PROMPTSUBST...

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Impact zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASHVERSION is set, so zsh gets the raw value. With the PROMPTSUBST option set, zs...

GHSA-5VJQ-RRRF-7H2Q virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Impact zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASHVERSION is set, so zsh gets the raw value. With the PROMPTSUBST option set, zs...

CVE-2026-113726

A flaw was found in virtualenv. When an environment activation script is sourced in the Z shell zsh, prompt values such as the environment name are not properly escaped. An attacker who convinces a user to activate a virtual environment with a maliciously crafted directory name or prompt...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the activate.sh bash activation script, which zsh also sources, when a virtualenv is created with a name containing shell metacharacters such as $.... Because zsh with PROMPTSUBST re-expands PS1 on every prompt dra...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the VIRTUALENVPROMPT variable in src/virtualenv/activation/bash/activate.sh. When a virtual environment is activated in bash or zsh, the prompt string is interpolated into PS1 without fully...

DEBIAN-CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

AZL-110076 CVE-2026-113726 affecting package python-pip 24.2-10

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

AZL-110100 CVE-2026-113726 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

The virtualenv tool is vulnerable to command injection when using the bash activate script in zsh with PROMPT_SUBST enabled. Prior to version 21.13.0, the environment name was left unescaped; from 21.13.0 until 21.14.4, it only escaped specific characters when BASH_VERSION was set, allowing zsh t...