Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M
CVE-2026-113776virtualenv activation scripts run code from a path that contains a placeholder name
High 7.8
In plain English
A high-severity OS command injection in virtualenv from pypa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value's quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-virtualenv | no fix listed | DEBIAN-CVE-2026-113776 |
| Debian:13 | python-virtualenv | no fix listed | DEBIAN-CVE-2026-113776 |
| Debian:14 | python-virtualenv | no fix listed | DEBIAN-CVE-2026-113776 |
| PyPI | virtualenv | 21.14.2 | GHSA-8rjx-v5ww-45pp |
| Ubuntu:26.04:LTS | python-virtualenv | no fix listed | UBUNTU-CVE-2026-113776 |
| Ubuntu:26.10 | python-virtualenv | no fix listed | UBUNTU-CVE-2026-113776 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pypa | virtualenv | >= 20.26.6, < 21.14.2 |
Weakness: CWE-78, CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp x_refsource_CONFIRM
- https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74 x_refsource_MISC
- https://github.com/pypa/virtualenv/releases/tag/21.14.2 x_refsource_MISC