virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

影響: pip:virtualenv < 21.14.9 → 21.14.9

A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…

GitHub Advisory Databaseで読む

2026/10/22 06:30、GitHub Advisory Databaseが「virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python。CVE: CVE-2026-113722。