CVE-2026-113776 virtualenv - Command Injection

virtualenv 20.26.6 to < 21.14.2 contains a command injection caused by multiple placeholder substitutions in activation templates, letting attackers execute arbitrary commands when activating environments, exploit requires attacker-controlled path or prompt.

CVSS base score 7.8 /10
High
CISA KEV
Not listed
Public exploit
None known
View the NVD record ↗

Details

Type
Command Injection
Impact
Remote Code Execution
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
20 October 2026
Updated
21 October 2026
Weakness
CWE-78

Vendor fix

Update to version 21.14.2 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs