Activating a venv can execute shell commands from a directory name #160280

Bug report

An attacker can name a directory in an archive so that activating a freshly created virtual environment inside it runs a command as the developer or build account. A similar issue was fixed a few years ago (d48cc82) and virtualenv just had the equivalent bug fixed (GHSA-8rjx-v5ww-45pp).

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-160280: Replace venv activation script placeholders in a single pass #160283