Skip to content
Threat Feed
Subscribe

Tag

Virtualenv

1 brief RSS
high advisory

PyPA virtualenv: Zsh command injection in activate script (CVE-2026-113726)

The virtualenv activation script for zsh is vulnerable to command injection via the environment prompt when PROMPT_SUBST is enabled, allowing arbitrary code execution upon prompt rendering.

virtualenv +1 command-injection zsh cve-2026-113726 code-injection supply-chain python cve-2026-113776
3t 2c