CVE-2026-113725
Received Received - Intake

Command Injection in virtualenv Bash Activation Script

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-21
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113725
EUVD
EUVD-2026-105273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pypa virtualenv < 21.14.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the virtualenv tool, specifically versions 21.14.6 and earlier. The issue is in the bash activation script which fails to properly escape environment names containing special characters like backslashes or dollar signs in the PS1 prompt variable. This allows command injection when a user sources the activate script of an environment with a manipulated name.

Detection Guidance

Check the installed version of virtualenv with 'pip show virtualenv' or 'virtualenv --version'. If it is 21.14.6 or earlier, the system is vulnerable. Inspect environment names for special characters like backslashes, dollar signs, or backticks before sourcing the activate script.

  • Run 'env | grep VIRTUAL_ENV' to check active virtual environments and their paths.
Impact Analysis

An attacker could inject and execute arbitrary commands with the user's privileges when the user sources the activate script. This requires the attacker to influence the environment name, such as through a CI job, wrapper tool, or directory name in a cloned repository. The attack occurs each time the bash prompt is drawn.

Mitigation Strategies

Upgrade virtualenv to version 21.14.7 or later using 'pip install --upgrade virtualenv'. Alternatively, set 'VIRTUAL_ENV_DISABLE_PROMPT=1' before sourcing the activate script to disable prompt modifications.

  • Avoid using environment names containing special characters like backslashes, dollar signs, or backticks until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart