https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 17:45:06 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-102925 <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment&#39;s recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user&#39;s privileges. This issue is fixed in version 21.7.13.</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment&#39;s recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user&#39;s privileges. This issue is fixed in version 21.7.13.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-102925 https://vulnerability.circl.lu/vuln/pysec-2026-4013 <p><strong>Affected:</strong> PyPI: virtualenv</p> <p>The generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.</p> <p>`activate` is affected through the virtual environment&#39;s own path, on the branch that reports a relocated environment (`Virtual environment directory __VIRTUAL_ENV__ does not exist!`). For a destination named `x&#39;$(id)&#39;y`, `shlex.quote` emits `&#39;x&#39;&#34;&#39;&#34;&#39;$(id)&#39;&#34;&#39;&#34;&#39;y&#39;`; the inner `&#34;` closes the enclosing double quote and `$(id)` is left unquoted. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.</p> <p>`activate.fish` is affected through the interpreter&#39;s Tcl/Tk library paths (`set -gx TCL_LIBRARY &#39;__TCL_LIBRARY__&#39;`). The rendered line becomes `&#39;&#39;/tcl/(cmd)/lib&#39;&#39;`, and fish expands the `(cmd)` left between the adjacent quoted runs. The same doubling splits a path containing a space into two list elements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.</p> <p>This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered `activate.bat`.</p> <p>Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting `shlex.quote` applied.</p> <p><strong>Affected:</strong> PyPI: virtualenv</p> <p>The generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.</p> <p>`activate` is affected through the virtual environment&#39;s own path, on the branch that reports a relocated environment (`Virtual environment directory __VIRTUAL_ENV__ does not exist!`). For a destination named `x&#39;$(id)&#39;y`, `shlex.quote` emits `&#39;x&#39;&#34;&#39;&#34;&#39;$(id)&#39;&#34;&#39;&#34;&#39;y&#39;`; the inner `&#34;` closes the enclosing double quote and `$(id)` is left unquoted. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.</p> <p>`activate.fish` is affected through the interpreter&#39;s Tcl/Tk library paths (`set -gx TCL_LIBRARY &#39;__TCL_LIBRARY__&#39;`). The rendered line becomes `&#39;&#39;/tcl/(cmd)/lib&#39;&#39;`, and fish expands the `(cmd)` left between the adjacent quoted runs. The same doubling splits a path containing a space into two list elements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.</p> <p>This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered `activate.bat`.</p> <p>Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting `shlex.quote` applied.</p> https://vulnerability.circl.lu/vuln/pysec-2026-4013