CVE-2026-102937: virtualenv: Command injection via --prompt in activate.bat (batch activator)
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virtualenvto a version that resolves this vulnerability.Fixed in 21.7.12
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of affected virtualenv versions on Windows are exposed when they activate a generated environment using activate.bat. The injected command runs with the privileges of the user performing the activation.
What must an attacker control to exploit it?
The attacker must be able to influence the prompt value supplied through --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value. A malicious value containing a double quote can terminate the batch-file variable assignment and introduce cmd.exe operators.
Are environments affected at creation time or activation time?
The malicious prompt is inserted when the Windows batch activator is generated, but execution occurs when a user runs activate.bat. This means a generated environment may carry the injected command until it is activated.
What is the remediation?
Upgrade virtualenv to version 21.7.12 or later. If an immediate upgrade is not possible, do not create or activate Windows environments whose prompt or virtualenv configuration may be influenced by untrusted input.