Tag

Zsh

1 brief RSS

PyPA virtualenv: Zsh command injection in activate script (CVE-2026-113726)

The virtualenv activation script for zsh is vulnerable to command injection via the environment prompt when PROMPT_SUBST is enabled, allowing arbitrary code execution upon prompt rendering.

virtualenv +1 command-injection zsh cve-2026-113726 code-injection supply-chain python cve-2026-113776

3t 2c 3h ago