virtualenv 21.14.6

Direct Vulnerabilities

Known vulnerabilities in the virtualenv package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Command Injection Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash `activate` script (`src/virtualenv/activation/bash/activate.sh`). Bash processes `PS1` in two passes each time it draws the prompt: it first decodes backslash prompt escapes (e.g. `\\` becomes `\`, `\$` becomes `$`), then expands the result. The `activate` script escapes the environment name for the expansion pass only, so a backslash in the name undoes that escaping. An attacker who controls the virtual environment name - through the directory name, the `--prompt` flag, or the `VIRTUALENV_PROMPT` environment variable - can supply a name such as `a\$(touch PWNED)`, causing arbitrary shell commands to execute each time bash draws the prompt after the environment is activated. How to fix Command Injection? Upgrade `virtualenv` to version 21.14.7 or higher.	[,21.14.7)
H Command Injection Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash `activate` script (`src/virtualenv/activation/bash/activate.sh`). Bash processes `PS1` in two passes on every prompt redraw: it first decodes backslash prompt escapes (e.g. `\\` becomes `\`, `\$` becomes `$`), then expands the result. The activation script escaped the environment name for the expansion pass only, so a backslash in the name undoes that escaping. An attacker who controls the environment name - through the directory name, `--prompt`, or `VIRTUALENV_PROMPT` - can supply a name such as `a\$(touch PWNED)`, causing arbitrary shell commands to execute each time bash draws the prompt after the environment is activated. How to fix Command Injection? Upgrade `virtualenv` to version 21.14.7 or higher.	[,21.14.7)

Vulnerability

Vulnerable Version

Command Injection

Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script (src/virtualenv/activation/bash/activate.sh). Bash processes PS1 in two passes each time it draws the prompt: it first decodes backslash prompt escapes (e.g. \\ becomes \, \$ becomes $), then expands the result. The activate script escapes the environment name for the expansion pass only, so a backslash in the name undoes that escaping. An attacker who controls the virtual environment name - through the directory name, the --prompt flag, or the VIRTUALENV_PROMPT environment variable - can supply a name such as a\$(touch PWNED), causing arbitrary shell commands to execute each time bash draws the prompt after the environment is activated.

How to fix Command Injection?

Upgrade virtualenv to version 21.14.7 or higher.

[,21.14.7)

Command Injection

Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script (src/virtualenv/activation/bash/activate.sh). Bash processes PS1 in two passes on every prompt redraw: it first decodes backslash prompt escapes (e.g. \\ becomes \, \$ becomes $), then expands the result. The activation script escaped the environment name for the expansion pass only, so a backslash in the name undoes that escaping. An attacker who controls the environment name - through the directory name, --prompt, or VIRTUALENV_PROMPT - can supply a name such as a\$(touch PWNED), causing arbitrary shell commands to execute each time bash draws the prompt after the environment is activated.

How to fix Command Injection?

Upgrade virtualenv to version 21.14.7 or higher.

[,21.14.7)

virtualenv@21.14.6

Virtual Python Environment builder

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically