CVE-2026-102937

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-10-02

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102937

EUVD

EUVD-2026-89464

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.7.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects virtualenv, a tool for creating isolated Python environments. Before version 21.7.12, the BatchActivator.quote() function returns prompt text without modification. Attackers can inject double quotes into the prompt via --prompt, VIRTUALENV_PROMPT, or configuration values. This allows them to alter cmd.exe commands, executing arbitrary code with the user's privileges when the environment is activated.

Detection Guidance

Check the version of virtualenv installed on your system. If it is below 21.7.12, the system is vulnerable. Run: pip show virtualenv or virtualenv --version. Also inspect any virtual environments created with older versions for suspicious --prompt or VIRTUALENV_PROMPT values in activation scripts.

Impact Analysis

If you use virtualenv on Windows with versions before 21.7.12, an attacker could trick you into running malicious commands. This could lead to unauthorized access to your system, data theft, or installation of malware, all under your user account privileges.

Compliance Impact

This vulnerability allows arbitrary command execution via crafted prompt text in Windows environments. It could lead to unauthorized data access, modification, or exfiltration, which may violate GDPR (data protection) and HIPAA (health data security) requirements for access controls and integrity.

Mitigation Strategies

Upgrade virtualenv to version 21.7.12 or later immediately. Run: pip install --upgrade virtualenv. After upgrading, regenerate any affected virtual environments to ensure the fix is applied. Avoid using untrusted --prompt or VIRTUALENV_PROMPT values.

Hi! I’m here to help you understand CVE-2026-102937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70