Threats tagged 'bit-virtualenv-2026-113722'

virtualenv versions prior to 21.14.9 generate POSIX console launchers that improperly quote interpreter paths. This flaw allows command substitution and backtick expansion in the generated /bin/sh wrapper script if the interpreter path contains spaces or results in a shebang longer than 127 bytes. An attacker who can influence the environment destination can execute arbitrary commands with the user's privileges when the generated launcher is run. Existing launchers are not fixed by upgrading virtualenv alone and must be regenerated. The issue is fixed in version 21.14.9.