virtualenv bash activate runs commands from an environment name with a backslash before $

影響: pip:virtualenv <= 21.14.6 → 21.14.7

The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. Affected area src/virtualenv/activation/bash/activate.sh, the block that prepends the environment name to PS1. Attacker-controlled input The environment name: the environment directory's name, or the --prompt or VIRTUALENV_PROMPT value. A…

GitHub Advisory Database에서 읽기

2026. 10. 22. 오전 01:49, GitHub Advisory Database에서 "virtualenv bash activate runs commands from an environment name with a backslash before $"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-113725.