Threats tagged 'brew-poetry-cve-2026-113776'

A code injection vulnerability exists in Poetry's virtualenv activation scripts due to improper handling of placeholder names in environment paths or prompts. When a path contains a placeholder name such as __VIRTUAL_NAME__, the activation script may execute arbitrary shell commands during environment activation. This affects versions from 1.8.3_2 up to but not including 2.5.1_1. The issue is fixed in version 2.5.1_1.