CVE-2026-113722: virtualenv POSIX Console Launchers Vulnerability Leading to Shell Command Execution
Summary
CVE-2026-113722: virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax. Affects virtualenv versions < 21.14.9. Fixed in 21.14.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
virtualenv is a popular Python package that allows users to create isolated Python environments, enabling them to manage dependencies for different projects without conflicts. It is widely used in the Python community for its ability to simplify package management and deployment. However, a recent vulnerability has been identified in the way virtualenv generates POSIX console launchers, which can lead to serious security risks if exploited.
Vulnerability Detail
The vulnerability arises from the way virtualenv handles destination paths when generating POSIX console launchers. Specifically, if an attacker can influence the environment destination passed to virtualenv, they can craft a path that is interpreted as shell syntax. This can lead to arbitrary command execution when the user runs the generated launcher. The vulnerability is particularly concerning because it does not require the attacker to modify installed executables or control the user's app-data cache. The affected code is located in the ScriptMakerCustom class, where the interpreter path is not properly escaped, allowing for shell expansions to occur.
How To Fix
Latest published version: 21.14.12 as of 22 Oct 2026
pip install --upgrade "virtualenv==21.14.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.14.9
This is the first release that contains the fix.
pip install --upgrade "virtualenv==21.14.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using destination paths that are derived from untrusted input. Additionally, users can create environments in directories that are controlled and trusted to mitigate the risk of exploitation.
Conclusion
The vulnerability identified as CVE-2026-113722 in the virtualenv package poses a significant risk due to its potential for arbitrary command execution. Users are strongly encouraged to update to the patched version 21.14.9 to secure their environments. Additionally, employing best practices for path management can help mitigate risks until an upgrade is feasible.
See every vulnerability recorded for virtualenv →
FAQ
CVE-2026-113722 is a vulnerability in the virtualenv package that allows for shell command execution through improperly handled destination paths in generated POSIX console launchers.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If exploited, this vulnerability can allow an attacker to execute arbitrary commands with the privileges of the user running the affected launcher, potentially compromising user data and processes.
Yes, a patch is available in version 21.14.9 of virtualenv. Users should upgrade to this version to mitigate the vulnerability.
If an immediate upgrade is not possible, avoid using untrusted paths for environment creation and consider using trusted directories to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for virtualenv.
