diff mbox series

[meta-python,wrynose,06/18] python3-virtualenv: fix CVE-2026-113726

Message ID 20261105090007.351866-7-hthakar@cisco.com
State New
Headers show
Series python3-virtualenv: Security fixes | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 8:59 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Backport the upstream Zsh prompt fix [1] identified by advisory [3].
Include prerequisite [2] to provide the prompt-escaping block and
regression-test fixture that the fix uses but 21.2.1 does not contain.

Escape prompt values before Zsh expands PS1, including when
PROMPT_SUBST is enabled after activation, and preserve literal percent
signs in the displayed environment name.

[1] https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2
[2] https://github.com/pypa/virtualenv/commit/a70c1dac43e2ee7e618132b572072395af5d8a9b
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../CVE-2026-113726-dependent.patch           | 168 ++++++++++++++++++
 .../python3-virtualenv/CVE-2026-113726.patch  | 149 ++++++++++++++++
 .../python/python3-virtualenv_21.2.1.bb       |   2 +
 3 files changed, 319 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726.patch
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch
new file mode 100644
index 0000000000..3c43b70fe8
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-virtualenv/CVE-2026-113726-dependent.patch
@@ -0,0 +1,168 @@ 
+From a70c1dac43e2ee7e618132b572072395af5d8a9b Mon Sep 17 00:00:00 2001
+From: Bernát Gábor <gaborjbernat@gmail.com>
+Date: Sat, 26 Sep 2026 09:35:09 -0700
+Subject: [PATCH]