{"id":"CVE-2026-113723","title":"virtualenv: Bash prompt values can change meaning under older compatibility modes","summary":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, …","severity":"high","cvss":7.1,"cvssVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-78"],"vendor":"pypa","product":"virtualenv","affected":["virtualenv < 21.14.9"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T19:51:06.340Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113723","references":[{"url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp","label":"https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp"},{"url":"https://github.com/pypa/virtualenv/pull/3418","label":"https://github.com/pypa/virtualenv/pull/3418"},{"url":"https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22","label":"https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22"},{"url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9","label":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T20:18:14.530Z","slug":"CVE-2026-113723","body":"## Overview\n\nvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.\n\n## Affected\n\n- `virtualenv < 21.14.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}