[ CVE-2026-113723 · Published 20 Oct 2026 ]
Vulnerability in pypa virtualenv
CVSS 7.1
EPSS <1%No fix listed yet
[ Description ]Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.