Command Injection Vulnerability in Virtualenv by Python Packaging Authority

CVE-2026-113723

What is CVE-2026-113723?

A command injection vulnerability exists in Virtualenv, a tool designed for creating isolated Python environments. In versions prior to 21.14.9, prompt text provided by the caller could be interpreted as executable syntax when activating the bash prompt. Attackers could potentially manipulate this passed value, posing a risk once the user activates the environment. The vulnerability has been addressed in version 21.14.9, which mitigates the risk by sanitizing the prompt input to prevent execution of unintended commands.

References