GHSA-VXJ4-Q4G9-CRJ7 virtualenv bash activate runs commands from an environment name with a backslash before $

Summary The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the user's shell each time bash draws the prompt. Affected area...

virtualenv bash activate runs commands from an environment name with a backslash before $

Summary The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the user's shell each time bash draws the prompt. Affected area...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via path interpolation in the generated activate.sh bash and activate.fish fish activation scripts. When a virtualenv is created with a path containing shell metacharacters, those characters are embedded unquoted into...