Vulnerability	Vulnerable Version
H Command Injection Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment prompt string in `activate.sh` when constructing `PS1`. When a virtualenv is created with a prompt value containing shell metacharacters (such as `$()` or backticks), the unescaped value is embedded directly into `PS1`. If bash subsequently evaluates `PS1` with `promptvars` enabled - whether by the user toggling `shopt -s promptvars`, entering posix mode, or by a child bash process inheriting the exported `PS1` - the embedded payload is executed as a shell command. Note: This is only exploitable when the virtualenv prompt is set to an attacker-influenced value and the activating shell has `promptvars` disabled at activation time (or the poisoned `PS1` is exported to a child shell). How to fix Command Injection? Upgrade `virtualenv` to version 21.14.13 or higher.	[21.14.9,21.14.13)

Command Injection

Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment prompt string in activate.sh when constructing PS1. When a virtualenv is created with a prompt value containing shell metacharacters (such as $() or backticks), the unescaped value is embedded directly into PS1. If bash subsequently evaluates PS1 with promptvars enabled - whether by the user toggling shopt -s promptvars, entering posix mode, or by a child bash process inheriting the exported PS1 - the embedded payload is executed as a shell command.

Note: This is only exploitable when the virtualenv prompt is set to an attacker-influenced value and the activating shell has promptvars disabled at activation time (or the poisoned PS1 is exported to a child shell).

How to fix Command Injection?

Upgrade virtualenv to version 21.14.13 or higher.

[21.14.9,21.14.13)

Go back to all versions of this package