HIGH 7.1 NVD
CVE-2026-113723
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash a
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
References
- https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
- https://github.com/pypa/virtualenv/pull/3418
- https://github.com/pypa/virtualenv/releases/tag/21.14.9
- https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-20 via NVD.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.