CVE-2026-113723CWE-78command-injection

CVE-2026-113723

published October 21, 2026

CVSS
7.1
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-21T00:17Z
References (4)
https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22 · [email protected]https://github.com/pypa/virtualenv/pull/3418 · [email protected]https://github.com/pypa/virtualenv/releases/tag/21.14.9 · [email protected]https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp · [email protected]
EPSS history
Timeline
  • 22 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 20 OCT 19:51Z
    virtualenv: Bash prompt values can change meaning under older compatibility modes
    cvelistv5
  • 20 OCT 19:51Z
    virtualenv: Bash prompt values can change meaning under older compatibility modes
    cvelistv5