Threats tagged 'brew-hatch-cve-2026-102925'

Hatch's virtualenv activation scripts for bash, zsh, and fish shells improperly handle quoting of paths containing shell metacharacters. This flaw allows embedded commands in such paths to execute when a user sources the activation script. The issue affects virtual environments relocated or copied to different machines and impacts environment variables like TCL_LIBRARY in fish shells. The vulnerability is fixed in version 1.18.1_1 by correcting the quoting approach.