CVE-2026-113723 in virtualenv
Summary
by MITRE • 10/20/2026
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within the virtualenv package prior to version 21.14.9 represents a significant security risk rooted in improper neutralization of special elements used in an OS command, commonly categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command or CWE-643 Improper Mitigation of X-Injection Issues within shell contexts. Virtualenv is widely utilized by Python developers to create isolated environments for different projects, ensuring that dependencies do not conflict across applications. The core function of this tool involves generating a self-contained directory structure containing the necessary executables and libraries, along with activation scripts designed to modify environment variables such as PATH when an user wishes to work within that specific context.
The technical flaw lies in how these activation scripts handle prompt customization. When creating or modifying a virtual environment, users can supply custom text for the shell prompt via command-line arguments or configuration files. In versions prior to 21.14.9, this caller-supplied prompt string was not adequately sanitized before being embedded into the bash activation script. Specifically, the value passed by the user is directly interpolated into the PS1 environment variable assignment within the generated activate.sh file without escaping special shell metacharacters such as backticks or dollar signs with parentheses. This lack of input validation allows an attacker who can influence the prompt string to inject arbitrary commands that will be interpreted and executed by the bash interpreter upon activation.
The operational impact of this vulnerability is contingent on a specific sequence of events, classifying it primarily as a client-side code injection scenario rather than a direct server-side compromise. An attacker must first have the ability to supply or influence the prompt value passed to virtualenv during environment creation. This could occur in scenarios where an organization uses automated build systems that accept external inputs for naming conventions, or if a malicious package is distributed with pre-configured activation scripts containing crafted prompts. Once such an environment is created, any user who activates it will inadvertently execute the injected code within their shell session. The execution context inherits the privileges of the activating user, potentially allowing for data exfiltration, installation of persistent backdoors, or lateral movement if the compromised account has broader network access.
This vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands like sh/bash. It also reflects CWE-20 Improper Input Validation, as the system failed to restrict or neutralize input that could alter program control flow. The risk is particularly acute in shared development environments where multiple users might source activation scripts from untrusted sources or automated pipelines that do not strictly validate environment metadata.
Mitigation for this issue involves upgrading virtualenv to version 21.14.9 or later, which implements proper escaping of special characters within the prompt string before embedding it into the activation script. For organizations unable to immediately patch, defensive measures include restricting the use of automated prompts in build pipelines and enforcing strict code review processes for any scripts that generate environment configurations. Additionally, security awareness training should emphasize caution when activating virtual environments sourced from untrusted or external contributors, as this remains a primary vector for exploitation even after patches are applied if legacy environments remain active.