Command Injection Vulnerability in Virtualenv by PyPa
CVE-2026-113726

7.8HIGH

Key Information:

Vendor

Pypa

Status
Virtualenv
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113726?

A command injection vulnerability exists in the bash activate script of virtualenv, a tool for creating isolated Python environments. Versions prior to 21.13.0 and from 21.13.0 to 21.14.4 are affected. The script fails to properly escape the environment name when used in zsh, allowing commands to be executed within the user's shell if the prompt contains influenced values or special syntax. This enables attackers to execute arbitrary commands each time the prompt is drawn. The issue is rectified in version 21.14.4.

Affected Version(s)

virtualenv < 21.14.4

References

https://github.com/pypa/virtualenv/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pypa/virtualenv/commit/5b915367da82bd0...
x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.4
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.