Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-113723virtualenv: Bash prompt values can change meaning under older compatibility modes

High 7.1

In plain English

A high-severity OS command injection in virtualenv from pypa. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 84.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113723
Debian:13	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113723
Debian:14	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113723
PyPI	virtualenv	21.14.9	GHSA-6w3r-xr62-4xcp
Ubuntu:26.04:LTS	python-virtualenv	no fix listed	UBUNTU-CVE-2026-113723
Ubuntu:26.10	python-virtualenv	no fix listed	UBUNTU-CVE-2026-113723

Affected products (as reported)

Vendor	Product	Versions
pypa	virtualenv	< 21.14.9

Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp x_refsource_CONFIRM
https://github.com/pypa/virtualenv/pull/3418 x_refsource_MISC
https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22 x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.9 x_refsource_MISC