virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

影響: pip:virtualenv < 21.14.9 → 21.14.9

A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…

在 GitHub Advisory Database 阅读

2026/10/22 06:30，GitHub Advisory Database 发布了“virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-113722。