Command Injection Vulnerability in Python Virtual Environment Tool by PyPa
CVE-2026-113725

7.8HIGH

Key Information:

Vendor

Pypa

Status
Virtualenv
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113725?

A command injection vulnerability exists in the virtualenv tool, which creates isolated Python environments. Prior to version 21.14.7, the bash activate script incorrectly handles the escaping of environment names during the prompt processing in Bash. Specifically, it only escapes the environment name during one of the two passes Bash makes over the PS1 variable. As a result, if the environment name contains a backslash, it can lead to unintended command execution in the user's shell every time the prompt is displayed. This issue has been addressed in version 21.14.7, which corrects the escaping mechanism to enhance security.

Affected Version(s)

virtualenv < 21.14.7

References

https://github.com/pypa/virtualenv/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pypa/virtualenv/commit/c3104e02474b652...
x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.7
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.