CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

CVSS 4.0

7.1CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-78

Published

2026-10-20

Modified

2026-10-22

Record from

the NVD, synced 2026-10-23

Packages (OSV)

References

• https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
• https://github.com/pypa/virtualenv/pull/3418
• https://github.com/pypa/virtualenv/releases/tag/21.14.9
• https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp

Check your stackJSON