-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper quoting during template substitution in activation scripts. The ViaTemplateActivator class's replacement logic (via_template.py) failed to properly escape magic template variables like VIRTUAL_ENV, which are populated from user-controlled paths. This allows command injection when malicious paths containing shell metacharacters are used. The PR #2771 explicitly adds a 'quote' method to ViaTemplateActivator to fix this, confirming this as the root cause. The activate_this.py template (and similar activation scripts) are vulnerable endpoints where unquoted variables are injected into executable code.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| virtualenv | pip | < 20.26.6 | 20.26.6 |