Description (CNA)
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| pypa / virtualenv | affected < 21.14.9 |
CWE
CWE-78