CVE-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-113723

The virtualenv tool, used for creating isolated Python environments, is vulnerable to OS Command Injection (CWE-78) in versions prior to 21.14.9 . The root cause is that caller-supplied prompt text can be interpreted as executable syntax within the bash activation prompt when using older compatib...

CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

RLSA-2026:84594 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

environment-modules security update

An update is available for environment-modules. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The environment-modules packages provide dynamic modification of...

CVE-2026-109440

LangAlpha versions through 2026.09.07 are susceptible to an indirect prompt injection vulnerability. This flaw allows remote attackers to execute shell commands or Python code by embedding malicious instructions within web content retrieved by the agent. The vulnerability exists because the Bash ...

CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

PT-2026-120138

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.4 Description The bash activate script, which is also sourced by zsh, fails to properly escape the environment name. In versions prior to 21.13.0, the name remains unescaped. In versions 21.13.0 through...

RockyLinux 9 : environment-modules (RLSA-2026:84594)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:84594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable h...

MiracleLinux 9 : environment-modules-5.3.0-2.el9_8.1 (AXSA:2026-2099:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2099:02 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenab...

Oracle Linux 10 : environment-modules (ELSA-2026-80664)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-80664 advisory. 5.6.1-2.1 - fix command injection in bash Tab completion CVE-2026-85013 RHEL-260562 Tenable has extracted the preceding description block directly from the...

PT-2026-120140

Name of the Vulnerable Software and Affected Versions virtualenv versions 20.26.6 through 21.14.1 Description The ViaTemplateActivator.instantiate template function replaces placeholders sequentially across the activation template. This allows trigger names like VIRTUAL NAME , VIRTUAL ENV , or...

SUSE SLES15: kubernetes1.37-client / kubernetes1.37-client-bash-completion / etc (SUSE-SU-2026:4740-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4740-1 advisory. This update for kubernetes rebuilds it against the current go security release. Tenable has extracted the preceding description block direct...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.4. This vulnerability stems from improper escaping of environment names in the bash activate script. When PROMPTSUBST is enabled in zsh, values such as environment directories, --prompt, or...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.7. This vulnerability stems from incomplete escaping of environment variables in the bash activate script; backslashes can be unescaped, allowing commands to be executed in the user’s shell when names...

Python Packaging Authority virtualenv command injection vulnerability

The Python Packaging Authority’s virtualenv versions prior to 21.14.9 have a command injection vulnerability. This vulnerability arises from the prompt text provided by the caller potentially becoming executable syntax in the bash activation prompt, which can lead to command injection...