SB2026092254 - OS Command Injection in py3-virtualenv

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to improper neutralization of special elements used in an os command in the generated bash, zsh, and fish activation scripts when a user sources an activation script generated for a path containing shell metacharacters. A remote attacker can provide a crafted path containing shell metacharacters to execute arbitrary commands.

User interaction is required to source the crafted activation script.

Remediation

Install update from vendor's website.

References

• https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2
• https://github.com/pypa/virtualenv/pull/3252