J'C Kabunga

I've also had a similar experience. 

It seems that this vulnerability is more of an issue with the Python executable than pyenv. As far as I'm aware, pyenv doesn't ship custom Python installs, it's just a...

You're right. I just confirmed it with a normal python installation (no pyenv). I'm pinging the author. @kirankotari, sorry for the ping, but could you please have a look at...

My best guess is that there could be two reasons why this vulnerability exists: 1. It's something to do with the `pyenv exec` code that ends up calling the injected...

Just confirmed: It's not an issue with the batch file. I tested using the following code: ```bat :: test.bat @echo off chcp 1250 > NUL call echo %~n0 %* ```...

I think I found it. The problem exists in unsanitized arguments inside the `pyenv.bat` file. https://github.com/pyenv-win/pyenv-win/blob/1f17991e43b0598847c3d5de511d816c6f9c89c9/pyenv-win/bin/pyenv.bat#L65-L83 Specifically, on lines 74 and 75, where the scripts arguments are taken without sanitization,...

+1