Vulnerability Description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
Related Weaknesses (CWE)
References
- https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b
- https://github.com/pypa/virtualenv/pull/3418
- https://github.com/pypa/virtualenv/releases/tag/21.14.9
- https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp
- https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp
FAQ
What is CVE-2026-113723?
CVE-2026-113723 is a documented vulnerability. virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influ...
How severe is CVE-2026-113723?
CVSS scoring is not yet available for CVE-2026-113723. Check NVD for updates.
Is there a patch for CVE-2026-113723?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.