{"id":"ghsa-ghsa-c978-59m8-c77v","seq":96666,"kind":"advisory","title":"virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax","url":"https://github.com/advisories/GHSA-c978-59m8-c77v","permalink":"https://vulnpulse.app/items/ghsa-ghsa-c978-59m8-c77v","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nA destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…","severity":"high","techs":["python"],"cves":["CVE-2026-113722"],"tags":["GHSA-c978-59m8-c77v","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T21:30:12.000Z","fetched_at":"2026-10-22T00:22:51.452Z"}