EUVD-2026-106868

virtualenv activation scripts run code from a path that contains a placeholder name...

Exploit for CVE-2026-109618

PHP Security Check A read-only Bash-based inventory tool for...

RHEL 10 : environment-modules (RHSA-2026:80664)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:80664 advisory. The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information...

Rocky Linux 9 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_84594)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202684594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable has...

RockyLinux 10 : environment-modules (RLSA-2026:80664)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the VIRTUALENVPROMPT variable in src/virtualenv/activation/bash/activate.sh. When a virtual environment is activated in bash or zsh, the prompt string is interpolated into PS1 without fully...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script src/virtualenv/activation/bash/activate.sh. Bash processes PS1 in two passes each time it draws the prompt: it first decodes backsla...

DEBIAN-CVE-2026-113776

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

CVE-2026-113776

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

AZL-110106 CVE-2026-113776 affecting package python-virtualenv for versions less than 20.36.1-10

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

DEBIAN-CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

AZL-110100 CVE-2026-113726 affecting package python-virtualenv for versions less than 20.36.1-10

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

AZL-110076 CVE-2026-113726 affecting package python-pip 24.2-10

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

CVE-2026-113776

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

CVE-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

CVE-2026-113776

The virtualenv tool, used for creating isolated Python environments, is vulnerable to OS Command Injection and Code Injection in versions 20.26.6 through 21.14.2 . The root cause lies in ViaTemplateActivator.instantiate_template(), which replaces placeholders (e.g., __VIRTUAL_NAME__, __VIRTUAL_EN...