CVE-2026-113723
virtualenv: Bash prompt values can change meaning under older compatibility modes
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
| CWE | CWE-78 |
| Vendor | pypa |
| Product | virtualenv |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for pypa virtualenv
Be the first to know when new unknown vulnerabilities affecting pypa virtualenv are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
pypa / virtualenv
< 21.14.9
References
github.com: https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp github.com: https://github.com/pypa/virtualenv/pull/3418 github.com: https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22 github.com: https://github.com/pypa/virtualenv/releases/tag/21.14.9