Template Replacement Issue in Virtualenv Affects Multiple Versions

CVE-2026-113776

What is CVE-2026-113776?

The virtualenv tool for creating isolated Python environments has a vulnerability that allows template placeholders in environment activation scripts to be replaced incorrectly. From versions 20.26.6 to 21.14.2, the method ViaTemplateActivator.instantiate_template() processes placeholders one at a time, risking the unintended execution of code when a user activates the environment. Specifically, placeholders like VIRTUAL_NAME, VIRTUAL_ENV, or VIRTUAL_PROMPT can be modified when quoted strings in an activation path or prompt are processed, leading to potential security issues. This vulnerability is mitigated in version 21.14.2, which addresses the flaws in placeholder handling.

References