Threats tagged 'brew-poetry-cve-2026-113732'

A command injection vulnerability exists in Poetry's virtualenv activate.fish script due to improper quoting of paths or prompts containing backslashes before quotes. This allows fish shell to interpret and execute injected commands when sourcing activate.fish. The issue affects all Poetry releases up to 1.2.2_1 and 2.5.1_1 that ship activate.fish. It was fixed in versions 1.2.2_1 and 2.5.1_1 by properly escaping backslashes and single quotes in activate.fish.