CVE-2026-115586

A flaw was found in virtualenv. This vulnerability allows a local attacker to achieve arbitrary code execution by supplying a crafted prompt name during virtual environment creation. Due to insufficient sanitization of special shell characters in the bash activation script, the prompt value can...

CVE-2026-113732

A flaw was found in virtualenv. The Fish shell activation script generator improperly sanitizes and quotes environment paths and prompt values. If an attacker can influence these values, specially crafted input can break out of the script's quoting syntax. Consequently, this flaw allows arbitrary...

CVE-2026-113725

A flaw was found in virtualenv. The bash activation script improperly escapes the virtual environment name when configuring the command prompt. If a user activates a virtual environment created with a specially crafted name, an attacker can achieve arbitrary code execution in the user's shell...

CVE-2026-113718

A flaw was found in virtualenv. This vulnerability could lead to arbitrary code execution when a user sources a generated xonsh activation script. Under certain multibyte character encodings, improper quoting of non-ASCII directory paths or prompt strings allows quote boundaries to be broken...

CVE-2026-102937

A flaw was found in virtualenv. An attacker can achieve arbitrary code execution by supplying specially crafted prompt values or environment configurations containing unescaped quote characters when generating Windows virtual environments. When a user executes the resulting activation script, the...

AZL-105675 CVE-2026-102925 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

virtualenv bash and fish activation scripts execute commands embedded in paths

The generated activate bash/zsh and activate.fish scripts interpolate ashlex.quote-ed value into a position that quotes it a second time. The extraquotes terminate the quoted run early and leave part of the value parsed asshell code, so a path containing shell metacharacters runs commands when a...

CVE-2026-44190

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44190

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44190 Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script setting

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

EUVD-2026-47651

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44190 Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script setting

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44190

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

MiracleLinux 7 : python3-3.6.8-21.0.3.el7.AXS7 (AXSA:2025-9726:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9726:01 advisory. - CVE-2024-9287: fix path names quoting to prevent command injection in virtual environment activation scripts CVEs: CVE-2024-9287 A vulnerability has been...

EUVD-2024-50376

Malicious code in bioql PyPI...

Astra Linux – Vulnerability in Python 3.11

A vulnerability has been identified in the CPython venv module and CLI. This vulnerability arises from improper quoting of path names when creating a virtual environment. As a result, attackers can inject commands into the virtual environment “activation” scripts e.g., using “source...

Medium: python3

Issue Overview: A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means...

CLSA-2025-1742466441 Fix CVE(s): CVE-2024-9287

SECURITY UPDATE: Incorrect path quoting in venv allows command injection - debian/patches/CVE-2024-9287.patch: Quote template strings in venv activation - CVE-2024-9287...

Python virtualenv Command Execution

The vulnerability of Python virtualenv activation scripts is related to the failure to take measures to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

python: Virtual environment (venv) activation scripts don't quote paths

A vulnerability has been found in the Python venv module and CLI. Path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts, for example, "source venv/bin/activate". This flaw allows...