CVE-2026-113722

Received Received - Intake

Command Injection in virtualenv Python Environment

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user's privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113722

EUVD

EUVD-2026-105304

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects virtualenv versions before 21.14.9. It involves improper quoting of interpreter paths in generated POSIX console scripts. When paths contain spaces or exceed 127 bytes, distlib creates a shell wrapper with a double-quoted interpreter path. This allows command substitutions and backticks to execute, enabling attackers to run arbitrary commands with the user's privileges when the launcher is executed.

Detection Guidance

Check virtualenv version with pip show virtualenv. If version is 21.14.8 or earlier, the system is vulnerable. Inspect generated launchers in bin/ or Scripts/ directories for improperly quoted interpreter paths or shebangs longer than 127 bytes.

Impact Analysis

If you use a vulnerable virtualenv version and create a virtual environment with a malicious path containing shell commands, attackers could execute code on your system when you run generated launchers like bin/pip. This could lead to data theft, system compromise, or further attacks, all under your user privileges.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. Unauthorized access to personal or health data could result in compliance breaches, legal penalties, and reputational damage for organizations handling such data.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later. Recreate all virtual environments with trusted paths. Avoid using pip installations that may reintroduce vulnerable launchers. Manually inspect and regenerate existing launchers if necessary.

Hi! I’m here to help you understand CVE-2026-113722. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70