Threats tagged 'ghsa-grqq-hcc7-crmr'

A vulnerability in the CPython venv module and CLI allows command injection via improperly quoted path names when creating virtual environments. This enables attacker-controlled virtual environments to execute arbitrary commands upon activation using the 'source venv/bin/activate' script. Virtual environments not created by an attacker or those used without activation (e.g., directly invoking the Python binary) are not affected.