## virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-113722
- 公開日時: 2026-10-21T21:30:12.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-c978-59m8-c77v)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-c978-59m8-c77v

影響: pip:virtualenv < 21.14.9 → 21.14.9
A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…