virtualenv bash and fish activation scripts execute commands embedded in paths

Impact The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs comman...

CVE-2022-1388

CVE-2022-1388 Checking and exploit for CVE-2022-1388 Installation: python3 -m pip install -r requirements.txt Usage Single : python3 cve.py s fullurl apicommand example python3 cve.py s http://127.0.0.1:8000/mgmt/tm/util/bash '"command":"run","utilCmdArgs":"-c id"' Mass : python3 cve.py m host li...

Rocky Linux 8.6 [CIQ] Security Update: virt-v2v / virt-v2v-bash-completion / virt-v2v-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0844)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260844 advisory. This advisory aggregates security fixes for the virt-v2v SRPM in CIQ LTS 8.6. It addresses 6 CVEs: CVE-2021-3507, CVE-2022-0897, CVE-2022-2211,...

Rocky Linux 8.6 [CIQ] Security Update: libnbd / libnbd-bash-completion / libnbd-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0833)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260833 advisory. This advisory aggregates security fixes for the libnbd SRPM in CIQ LTS 8.6. It addresses 6 CVEs: CVE-2022-23645, CVE-2022-0897, CVE-2021-3507,...

Rocky Linux 9.6 [TuxCare] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc (ALMALINUX9.6:CLSA-2026:1777021155)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777021155 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 8.6 [CIQ] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc Multiple Vulnerabilities (ciqsa-2026_0843)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260843 advisory. This advisory aggregates security fixes for the nbdkit SRPM in CIQ LTS 8.6. It addresses 6 CVEs: CVE-2021-3507, CVE-2023-2700, CVE-2022-4144,...

AlmaLinux 9.6 [TuxCare] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc (ALMALINUX9.6:CLSA-2026:1777021155)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777021155 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 9 [CIQ] Security Update: bash / bash-debuginfo / bash-debugsource / bash-devel (crlsa-2023_0340)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230340 advisory. bash: a heap-buffer-overflow in validparametertransform CVE-2022-3715 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 8.6 [CIQ] Security Update: libguestfs / libguestfs-appliance / libguestfs-bash-completion / etc Multiple Vulnerabilities (ciqsa-2026_0839)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260839 advisory. This advisory aggregates security fixes for the libguestfs SRPM in CIQ LTS 8.6. It addresses 6 CVEs: CVE-2021-3507, CVE-2023-2700, CVE-2022-4144,...

Rocky Linux 8.6 [CIQ] Security Update: libguestfs / libguestfs-appliance / libguestfs-bash-completion / etc Multiple Vulnerabilities (ciqsa-2026_0074)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260074 advisory. This advisory aggregates security fixes for the libguestfs SRPM in CIQ LTS 8.6. It addresses 7 CVEs: CVE-2024-3446, CVE-2013-4419, CVE-2011-4127,...

Linux Distros Unpatched Vulnerability : CVE-2026-102925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place...

AlmaLinux 9.6 [TuxCare] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc (ALMALINUX9.6:CLSA-2026:1775809438)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775809438 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 9.6 [TuxCare] Security Update: nbdkit / nbdkit-bash-completion / nbdkit-basic-filters / etc (ALMALINUX9.6:CLSA-2026:1775809438)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775809438 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

CentOS Linux 6 [TuxCare] Security Update: bash / bash-doc (CENTOS6:CLSA-2026:1777446568)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777446568 advisory. - rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any command with the...

DEBIAN-CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

AZL-105675 CVE-2026-102925 affecting package python-virtualenv for versions less than 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

UBUNTU-CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

CVE-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...