Threats tagged 'brew-virtualenvwrapper-cve-2026-102925'

Virtualenvwrapper versions >=6.1.1 and <6.1.1_3 contain a vulnerability in the bash/zsh and fish activation scripts where shell metacharacters embedded in virtual environment paths are improperly quoted. This allows execution of arbitrary commands when the activation script is sourced. The issue arises from double quoting of shlex.quote-escaped values, which prematurely terminates the quoted string and leaves shell code unquoted and executable. The flaw affects the activate script when the virtual environment path is relocated or copied, and the activate.fish script through Tcl/Tk library path variables. The vulnerability is fixed in version 6.1.1_3 by adjusting quoting to apply shlex.quote only once.