Command InjectionAffected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment prompt string in activate.sh when constructing PS1. When a virtualenv is created with a prompt value containing shell metacharacters (such as $() or backticks), the unescaped value is embedded directly into PS1. If bash subsequently evaluates PS1 with promptvars enabled - whether by the user toggling shopt -s promptvars, entering posix mode, or by a child bash process inheriting the exported PS1 - the embedded payload is executed as a shell command.
Note: This is only exploitable when the virtualenv prompt is set to an attacker-influenced value and the activating shell has promptvars disabled at activation time (or the poisoned PS1 is exported to a child shell).
How to fix Command Injection? Upgrade virtualenv to version 21.14.13 or higher.
| |
Insecure Temporary FileAffected versions of this package are vulnerable to Insecure Temporary File via the FromAppData seeder in src/virtualenv/seed/embed/via_app_data/via_app_data.py when --symlink-app-data is used with a transient (temporary) app-data directory. Because the app-data directory is removed after virtualenv creation, symlinks placed into the new environment point to a now-deleted location, allowing a local attacker who can recreate that path to substitute malicious content and achieve arbitrary file writes into the virtual environment's site-packages.
How to fix Insecure Temporary File? Upgrade virtualenv to version 21.14.10 or higher.
| |
Symlink AttackAffected versions of this package are vulnerable to Symlink Attack via the FromAppData seed mechanism in src/virtualenv/seed/embed/via_app_data/via_app_data.py, when symlink_app_data is enabled against a transient (temporary) app-data store. In this configuration, virtualenv creates symlinks from the newly created virtual environment's seed packages to temporary files that are deleted after setup completes, leaving the environment with dangling symlinks. An attacker who can write to the temporary directory before or after deletion can substitute malicious package files that the virtual environment then resolves through those symlinks, leading to arbitrary code execution within the environment.
Note: This is only exploitable when symlink_app_data is enabled and virtualenv is configured to use a transient app-data store, either via environment variables or configuration files.
How to fix Symlink Attack? Upgrade virtualenv to version 21.14.10 or higher.
| |
