534 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-113776
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholde...
Virtualenv Activate.fish Runs Commands From A Path Or Prompt With A Backslash Before A Quote
Impact "FishActivator" defines no "quote", so it inherits "ViaTemplateActivator.quote", which returns "shlex.quotestring". That function follows POSIX "sh" rules, where a backslash inside single quotes stays a literal character. fish reads "'" inside single quotes as an escaped quote and "\" as...
Virtualenv Activation Scripts Run Code From A Path That Contains A Placeholder Name
Impact "ViaTemplateActivator.instantiatetemplate" replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted...
EUVD-2026-106868
virtualenv activation scripts run code from a path that contains a placeholder name...
CVE-2026-113732
A flaw was found in virtualenv. The Fish shell activation script generator improperly sanitizes and quotes environment paths and prompt values. If an attacker can influence these values, specially crafted input can break out of the script's quoting syntax. Consequently, this flaw allows arbitrary...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via FishActivator, which inherits shlex.quote for escaping shell arguments. The POSIX quoting rules applied by shlex.quote leave backslash characters literal inside single quotes, but the fish shell treats ' as an...
DEBIAN-CVE-2026-113732
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
DEBIAN-CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113732
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113776
The virtualenv tool, used for creating isolated Python environments, is vulnerable to OS Command Injection and Code Injection in versions 20.26.6 through 21.14.2 . The root cause lies in ViaTemplateActivator.instantiate_template(), which replaces placeholders (e.g., __VIRTUAL_NAME__, __VIRTUAL_EN...
CVE-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113776
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
CVE-2026-113732
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
CVE-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
PT-2026-120140
Name of the Vulnerable Software and Affected Versions virtualenv versions 20.26.6 through 21.14.1 Description The ViaTemplateActivator.instantiate template function replaces placeholders sequentially across the activation template. This allows trigger names like VIRTUAL NAME , VIRTUAL ENV , or...
CVE-2026-111720
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or clou...
CVE-2026-111720
The fish-island-backend software (specifically versions through commit 7c61b78 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. This flaw exists in the GET /api/web/parse endpoint, where the application fails to properly validate the url parameter. Remote at...