SecBoard
Zurück zur CVE-Übersicht

CVE-2026-102937

NONE
Risk Signal Score0/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 21.7.12

Threat-Hunting-Queries

This vulnerability involves command injection via a crafted prompt in virtualenv's activate.bat on Windows. Detection should focus on unusual process creation originating from activate.bat or related virtualenv scripts, especially commands that are not typical for environment activation.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "activate.bat"
| where ProcessCommandLine matches regex @"\"\s*(&|\||<|>|\^|!)"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

index=windows_events (sourcetype=WinEventLog:Security OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational)
| search (ParentCommandLine="*activate.bat*" OR CommandLine="*activate.bat*") AND (CommandLine="*\" & *" OR CommandLine="*\" | *" OR CommandLine="*\" < *" OR CommandLine="*\" > *" OR CommandLine="*\" ^ *" OR CommandLine="*\" ! *")
| table _time, host, ParentCommandLine, CommandLine, Image, Hashes

Sigma

title: Virtualenv Activate.bat Command Injection
status: experimental
description: Detects potential command injection attempts via crafted prompts in virtualenv's activate.bat on Windows.
author: SecBoard
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentCommandLine|contains: 'activate.bat'
    CommandLine|contains:
      - '" & '
      - '" | '
      - '" < '
      - '" > '
      - '" ^ '
      - '" ! '
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
level: high

Elastic ES|QL

FROM process WHERE process.parent.command_line : "*activate.bat*" AND process.command_line : ("*\" & *", "*\" | *", "*\" < *", "*\" > *", "*\" ^ *", "*\" ! *")
| SELECT @timestamp, host.name, process.parent.command_line, process.command_line, process.executable, process.hash.sha256

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

GitHub Advisories

GHSA-x78j-v8h9-3j2qHIGH

virtualenv: Command injection via --prompt in activate.bat (batch activator)

pip/virtualenv→ 21.7.12
GitHub Advisory

Referenzen