CVE-2026-113723: virtualenv: Bash prompt values can change meaning under older compatibility modes

Q: Who is exposed to this issue?

Users of virtualenv versions before 21.14.9 are exposed when an attacker can influence the prompt value supplied when a virtual environment is created. Exploitation also requires a user to activate that environment in Bash and cause the prompt to be displayed.

Q: Does exploitation require the attacker to already have access to the target system?

The vulnerability does not require attacker privileges, but it does require the attacker to control or influence caller-supplied prompt text. User interaction is required afterward: the affected environment must be activated and its prompt drawn.

Q: What version fixes the issue?

Upgrade virtualenv to version 21.14.9 or later. The issue affects versions prior to 21.14.9.

Published Oct 20, 2026

Updated

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

Affected Software

1 affected component

pypi/virtualenv<21.14.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade virtualenv to a version that resolves this vulnerability.
Fixed in 21.14.9

Event History

Oct 20, 2026

CVE Published

via MITRE·07:51 PM

Data Sourced

via MITRE·07:51 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of virtualenv versions before 21.14.9 are exposed when an attacker can influence the prompt value supplied when a virtual environment is created. Exploitation also requires a user to activate that environment in Bash and cause the prompt to be displayed.

Does exploitation require the attacker to already have access to the target system?

The vulnerability does not require attacker privileges, but it does require the attacker to control or influence caller-supplied prompt text. User interaction is required afterward: the affected environment must be activated and its prompt drawn.

What version fixes the issue?

Upgrade virtualenv to version 21.14.9 or later. The issue affects versions prior to 21.14.9.

CVE-2026-113723: virtualenv: Bash prompt values can change meaning under older compatibility modes

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require the attacker to already have access to the target system?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require the attacker to already have access to the target system?

What version fixes the issue?