virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
影響: pip:virtualenv < 21.14.9 → 21.14.9
A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…
Read on GitHub Advisory Database
| CVE | CVE-2026-113722 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/22/2026, 09:22 AM |
| Data | Markdown JSON |
On 10/22/2026, 06:30 AM, GitHub Advisory Database published "virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-113722.