---
id: CVE-2026-113723
title: >-
  virtualenv: Bash prompt values can change meaning under older compatibility
  modes
summary: >-
  virtualenv is a tool for creating isolated virtual python environments. Prior
  to 21.14.9, caller-supplied prompt text can become executable syntax in the
  bash activation prompt. An attacker must influence the value passed to
  virtualenv, …
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-78
vendor: pypa
product: virtualenv
affected:
  - virtualenv < 21.14.9
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T19:51:06.340Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113723'
references:
  - url: 'https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp'
    label: 'https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp'
  - url: 'https://github.com/pypa/virtualenv/pull/3418'
    label: 'https://github.com/pypa/virtualenv/pull/3418'
  - url: >-
      https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
    label: >-
      https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
  - url: 'https://github.com/pypa/virtualenv/releases/tag/21.14.9'
    label: 'https://github.com/pypa/virtualenv/releases/tag/21.14.9'
tags:
  - cve.org
ingestedAt: '2026-10-20T20:18:14.530Z'
---

## Overview

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

## Affected

- `virtualenv < 21.14.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.