CVE-2026-113776

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in virtualenv Python Environment

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value's quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113776

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	>= 20.26.6, < 21.14.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects virtualenv, a tool for creating isolated Python environments. Between versions 20.26.6 and 21.14.2, a flaw in the template activation process allows placeholder names like __VIRTUAL_NAME__ to be replaced multiple times during environment activation. This can lead to command execution when a user activates the environment via bash, fish, xonsh, or activate_this.py if an attacker influences the destination path or prompt.

Detection Guidance

Check the installed version of virtualenv using pip show virtualenv. If the version is between 20.26.6 and 21.14.1, the system is vulnerable.

Impact Analysis

If you use a vulnerable version of virtualenv, an attacker could craft a malicious path or prompt that executes arbitrary commands when you activate a virtual environment. This requires the attacker to influence the path or prompt settings, but could lead to code execution on your system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing command execution through environment variable manipulation. If exploited, it may lead to unauthorized access or data breaches, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade virtualenv to version 21.14.2 or later using pip install --upgrade virtualenv. Avoid using untrusted paths or prompts that may contain placeholders.

Hi! I’m here to help you understand CVE-2026-113776. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...