CVE-2026-113718

Received Received - Intake

POSIX xonsh Activation Quote Escape in virtualenv

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113718

EUVD

EUVD-2026-105299

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects the virtualenv tool, which creates isolated Python environments. In versions before 21.14.9, the xonsh activation script uses repr() to write non-ASCII prompt or destination data into a UTF-8 file. When xonsh reads this file using legacy encodings like GBK or Big5, certain UTF-8 bytes can alter quote interpretation, allowing attackers to inject executable commands during environment activation.

Detection Guidance

To detect this vulnerability, check the installed version of virtualenv using pip show virtualenv. If the version is 21.14.8 or earlier, the system is vulnerable. Additionally, inspect xonsh activation scripts in virtual environments for non-ASCII characters or unusual escape sequences that could indicate manipulation.

Impact Analysis

An attacker could exploit this to run arbitrary commands with your user privileges when you activate a vulnerable virtual environment. This requires influencing the prompt or destination data passed to virtualenv and your use of a legacy encoding like GBK or Big5. Upgrading to version 21.14.9 or later mitigates the risk.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later using pip install --upgrade virtualenv. Recreate all virtual environments with the patched version to ensure activation scripts are regenerated. Avoid using untrusted prompt values when creating environments.

Hi! I’m here to help you understand CVE-2026-113718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70