Command Execution Vulnerability in virtualenv by pypa

CVE-2026-113722

What is CVE-2026-113722?

The virtualenv tool, utilized for creating isolated python environments, is susceptible to a command execution vulnerability due to an improperly quoted interpreter path passed to distlib's ScriptMaker. When generating POSIX console scripts, if the interpreter path includes a space or exceeds 127 bytes, it can lead to the execution of arbitrary commands with user privileges when launching a generated script. This flaw is particularly concerning for users who may trigger the execution unintentionally. To mitigate risks, it’s crucial to upgrade to virtualenv version 21.14.9 as merely updating the software will not repair existing launchers; these need to be regenerated. Furthermore, an affected launcher may also be reintroduced through subsequent pip installations or upgrades since pip's bundled version of distlib remains unchanged.

References