A command injection vulnerability exists in the bash activation script of virtualenv when the shell option 'promptvars' is off at activation time. The vulnerability arises because the '--prompt' value is inserted unescaped into the PS1 prompt variable, allowing command substitution to occur if prompt expansion is re-enabled later. This regression appeared in virtualenv version 21.14.9 and persists through 21.14.12. An attacker controlling the prompt value can execute arbitrary commands as the user activating the environment.
A vulnerability in virtualenv allows attacker-controlled prompt text to be interpreted as executable syntax in the bash activation prompt under older bash compatibility modes (4.2 and lower) and certain POSIX shell scenarios. This occurs when an attacker influences the prompt value passed to virtualenv, and a user activates the environment with the crafted prompt. The issue affects the POSIX activation scripts and certain shells like dash when PS1 is exported, leading to command execution upon prompt display. The vulnerability was introduced in virtualenv 20.0.0b1 and 21.14.7 and fixed in versions 2022.8.7_1 and 2026.10.20.
PyJWT versions up to 2.13.0 and current master before 2.26.0 contain a vulnerability where the HMAC verification accepts an empty key when using octet JWKs. This allows an attacker to forge tokens without knowing any secret if the application verifies tokens using a JWK/JWKS with an empty 'k' value. The issue arises because the empty key rejection implemented for string/bytes keys is not applied to keys loaded from JWKs. The vulnerability is fixed in PyJWT version 2.26.0.
The msgpack-python C extension has an unbounded memory leak when deserializing MessagePack data with strict_map_key validation enabled (default). This occurs because a decoded map value is leaked when a key is rejected, causing memory growth and potential denial of service. Additionally, the streaming Unpacker API may suffer from use-after-free crashes due to stale parser-stack references. The issue affects version 1.2.2 and development commits, with a fix available in version 2.5.1_1.
PyJWT versions up to 2.13.0 and the current master branch contain a vulnerability where the HMAC verification accepts an empty key when using JWKs with an oct key type and an empty 'k' value. This allows an attacker to forge tokens without knowledge of a secret if the application verifies tokens using such a JWK. The issue arises because the empty key rejection implemented for string/bytes secrets was not applied to the JWK verification path. This flaw is fixed in PyJWT version 0.12.0_5.
CVE-2026-115877 is an HTTP request smuggling vulnerability in the Twisted HTTP server (twisted.web.http.HTTPChannel) affecting versions 26.4.0 and earlier. It arises from incomplete validation of header values, allowing bare carriage return (CR) or line feed (LF) characters to be included, which can cause a front-end proxy and Twisted to interpret request boundaries differently. This discrepancy enables an attacker to smuggle unauthorized requests past front-end controls, potentially bypassing access restrictions, poisoning shared connections, and caching responses improperly. The vulnerability does not allow code execution and requires a front-end proxy that treats bare CR or LF as line terminators. A proof-of-concept demonstrates how an attacker can smuggle a GET request hidden inside a POST request's headers. The CVSS score is 5.4 (medium severity).
Text::CSV_XS versions before 1.65 for Perl contain a vulnerability where numeric strings with leading or trailing whitespace can be written without quotes, causing record splitting. This occurs because the combine and print functions do not verify if a field requires quotes when its value has Perl's numeric flag set. As a result, a numeric value containing a newline can prematurely end a CSV record and cause subsequent fields to be interpreted as a new row.
PyJWT versions up to 2.13.0 and the current master branch have a vulnerability in the HMAC key verification process when using JWK/JWKS with symmetric keys (kty=oct). Specifically, the library accepts an empty HMAC key from a JWK without error, allowing an attacker to forge tokens by exploiting this empty key acceptance. This occurs because the empty key rejection implemented for string/bytes secrets was not applied to the JWK verification path. The vulnerability requires that the verifier resolve the HMAC key from a JWK/JWKS containing an empty 'k' value, which can happen due to misconfiguration or trust in a JWKS with such an entry. A fix is available in version 2.8.2_16.
PyJWT versions up to 2.13.0 and the current master commit accept an empty HMAC key when verifying tokens via the JWK/JWKS path, allowing attackers to forge tokens without knowing a secret. This occurs because the from_jwk method does not reject empty keys, unlike the string/bytes secret path which was fixed in 2.13.0. The vulnerability requires the verifier to resolve an HMAC key from a JWK with an empty 'k' value, which can happen due to misconfiguration or trusting a JWKS with such an entry.
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt.
When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.
An attacker who supplies an XLSX file can run arbitrary Perl code.