A flaw was found in virtualenv. The generated activation scripts for shells such as bash, zsh, and fish apply improper quoting to environment and library path variables. An attacker can exploit this by providing a crafted virtual environment path containing shell metacharacters. When an unsuspecting user sources the activation script, the embedded metacharacters are executed as shell commands, leading to arbitrary code execution with the privileges of that user.
Last checked: 2026-09-30 21:40 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 19:24 UTC)
Fix evidence last checked: 2026-10-04 14:36 UTC
Debian 12 (Bookworm)
Debian Security Tracker · Observed 2026-10-04