Threats tagged 'brew-poetry-cve-2026-113726'

A command injection vulnerability exists in the Poetry virtual environment activation script for zsh users with the PROMPT_SUBST option enabled. The vulnerability arises because the environment name is inserted into the shell prompt (PS1) without proper escaping under zsh, allowing crafted environment names containing command substitution syntax to execute arbitrary commands each time the prompt is drawn. This affects Poetry versions prior to 1.2.2_1 and 2.5.1_1. The issue is fixed in version 1.2.2_1 and 2.5.1_1 by properly escaping special characters in the prompt string.