Threats tagged 'brew-poetry-cve-2026-113725'

A command injection vulnerability exists in the bash activate script of virtual environments created by Poetry's virtualenv component. The vulnerability arises because the environment name is not properly escaped during both passes bash makes over the PS1 prompt variable, allowing specially crafted environment names containing backslash-dollar sequences to execute arbitrary commands each time the shell prompt is drawn. This affects users who source the activate script of an environment with an attacker-controlled name. The issue is fixed in Poetry virtualenv versions 1.2.2_1 and 2.5.1_1.