{"id":"CVE-2026-113723","title":"virtualenv: Bash prompt values can change meaning under older compatibility modes","summary":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, …","severity":"high","cvss":7.1,"cvssVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-78"],"vendor":"pypa","product":"virtualenv","affected":["virtualenv < 21.14.9"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-27T13:31:20.167759Z"},"exploitAvailable":true,"published":"2026-10-20","updated":"2026-10-27","sourceUpdated":"2026-10-27T13:31:27.357Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113723","references":[{"url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp","label":"https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp"},{"url":"https://github.com/pypa/virtualenv/pull/3418","label":"https://github.com/pypa/virtualenv/pull/3418"},{"url":"https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22","label":"https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22"},{"url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9","label":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113723"},{"url":"https://github.com/pypa/virtualenv"},{"url":"https://github.com/advisories/GHSA-6w3r-xr62-4xcp"}],"tags":["cve.org","exploit-available","osv","pip","ghsa"],"epss":0.00177,"epssPercentile":0.07255,"aliases":["GHSA-6w3r-xr62-4xcp"],"ecosystem":"pip","patched":["virtualenv 21.14.9"],"ingestedAt":"2026-10-20T20:18:14.530Z","slug":"CVE-2026-113723","body":"## Overview\n\nvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.\n\n## Affected\n\n- `virtualenv < 21.14.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-113723)\n\nAffected packages:\n\n- `virtualenv < 21.14.9`\n\nPatched in:\n\n- `virtualenv 21.14.9`\n\nSource: https://osv.dev/vulnerability/GHSA-6w3r-xr62-4xcp","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":229897,"id":"CVE-2026-113723","ts":1793117595955,"field":"exploit_available","old":"false","new":"true"}]}