CVE-2026-113725: virtualenv Bash Activate Command Injection Vulnerability
Summary
CVE-2026-113725: virtualenv bash activate runs commands from an environment name with a backslash before $. Affects virtualenv versions < 21.14.7. Fixed in 21.14.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
virtualenv is a popular Python package that allows users to create isolated Python environments. This isolation helps manage dependencies and versions for different projects without conflicts. However, a vulnerability has been identified in the bash 'activate' script, which can lead to arbitrary command execution if an attacker can influence the environment name.
Vulnerability Detail
The vulnerability arises from the way the bash 'activate' script handles the environment name when modifying the PS1 prompt. It escapes certain characters only during the second pass of prompt drawing, allowing an attacker to execute commands if the environment name contains a backslash followed by a command substitution. This can lead to arbitrary command execution in the user's shell with their privileges each time the prompt is drawn. The issue affects versions prior to 21.14.7, with the potential for serious ramifications if exploited.
How To Fix
Latest published version: 21.14.12 as of 22 Oct 2026
pip install --upgrade "virtualenv==21.14.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.14.7
This is the first release that contains the fix.
pip install --upgrade "virtualenv==21.14.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the environment variable VIRTUAL_ENV_DISABLE_PROMPT=1 before sourcing the activate script. This will prevent the PS1 prompt from being modified. You can do this by running the following command: 'export VIRTUAL_ENV_DISABLE_PROMPT=1'.
Conclusion
The CVE-2026-113725 vulnerability in virtualenv poses a significant risk due to its potential for arbitrary command execution. Users are strongly encouraged to update to the patched version 21.14.7 or later to mitigate this risk. Additionally, utilizing workarounds can provide temporary relief until an update can be applied.
See every vulnerability recorded for virtualenv →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If exploited, this vulnerability can lead to arbitrary command execution in the user's shell, potentially allowing an attacker to execute malicious commands with the user's privileges.
Versions of virtualenv prior to 21.14.7 are affected by this vulnerability.
If you cannot update the package immediately, consider using the workaround by setting VIRTUAL_ENV_DISABLE_PROMPT=1 before sourcing the activate script.
References
Related vulnerabilities
Recent vulnerabilities recorded for virtualenv.
