virtualenv activation scripts run code from a path that contains a placeholder name

影響: pip:virtualenv >= 20.26.6, <= 21.14.1 → 21.14.2 Impact ViaTemplateActivator.instantiate_template replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment. __VIRTUAL_NAME__ holds the environment's direc…

GitHub Advisory Databaseで読む