CVE-2026-113722 in virtualenv
Summary
by MITRE • 10/20/2026
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user's privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified involves the Python package management tool virtualenv, specifically affecting versions prior to 21.14.9. Virtualenv is widely used by developers and system administrators to create isolated environments for Python applications, ensuring dependency isolation and preventing conflicts between different projects. The core issue lies in how the ScriptMakerCustom component within virtualenv interacts with pip and distlib when generating POSIX console scripts. These scripts are shell wrappers that allow users to execute installed Python packages as if they were standalone commands. In vulnerable versions, the interpreter path passed from virtualenv to distlib is incompletely quoted during this generation process. This technical flaw creates a scenario where special characters in file paths can be interpreted by the underlying shell rather than being treated as literal string data.
The operational impact of this vulnerability stems directly from how POSIX shells handle double-quoted strings. While double quotes generally prevent word splitting and globbing, they do not disable command substitution using backticks or dollar signs when specific conditions are met. If an attacker can influence the destination path where a virtual environment is created such that it contains spaces or results in a shebang line exceeding 127 bytes, distlib generates a wrapper script with improperly escaped paths. When this wrapper is executed by a user, the shell interprets any command substitutions present in the path as executable commands. Consequently, an attacker who controls part of the directory structure leading to the virtual environment can achieve arbitrary code execution under the context of the user running the launcher. This represents a significant privilege escalation risk if the target user has elevated privileges or access to sensitive resources within their environment.
This vulnerability is categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack vector aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging shell scripts for execution. It is critical to note that the exploitation does not occur during environment creation or activation phases but rather when a user subsequently runs one of the generated launcher scripts. This delayed trigger mechanism makes detection more difficult as standard monitoring tools might not flag the initial setup process. Furthermore, existing launchers created in vulnerable environments are not automatically repaired by upgrading virtualenv to version 21.14.9 and later. They must be manually regenerated within a fixed environment to remove the maliciously crafted shebang lines.
Mitigation requires immediate action for any systems relying on affected versions of virtualenv. Organizations should upgrade virtualenv to version 21.14.9 or newer, which corrects the quoting logic in ScriptMakerCustom and ensures proper escaping of interpreter paths regardless of spaces or length constraints. After upgrading, it is essential to regenerate all console scripts within existing virtual environments to eliminate any previously generated vulnerable launchers. Additionally, attention must be paid to pip installations because pip vendors its own copy of distlib for script generation. Even if the main virtualenv package is updated, a later independent installation or upgrade of pip could reintroduce affected launchers due to an unchanged vendored version of distlib in older pip releases. Therefore, keeping both virtualenv and pip up to date is necessary to maintain security integrity across Python development workflows.