Threats tagged 'brew-poetry-cve-2026-113722'

A vulnerability in virtualenv's POSIX console launcher generation allows attacker-controlled destination paths to be interpreted as shell syntax. This occurs because the interpreter path is not properly escaped in the shell wrapper, enabling shell command injection when running generated launchers. The issue affects POSIX console scripts created by virtualenv's app-data seeder or pip when a shell wrapper is required. Windows executable launchers are not affected. Exploitation requires an attacker to influence the environment destination path and the user to run the generated launcher, resulting in execution of arbitrary shell commands with the user's privileges.