GHSA-8rjx-v5ww-45pp: OS Command Injection

Q: Who is realistically exposed to exploitation?

Users who activate a virtual environment created in a directory whose name is attacker-controlled or otherwise contains a later template placeholder name are exposed. Exploitation requires the user to source or otherwise run an affected activation script.

Q: Are default activation scripts affected?

Yes. The default bash activate script is affected, and the same payload executes through activate.fish. Python code execution was also demonstrated through activate.xsh and bin/activate_this.py.

Q: What does an attacker need to control?

The attacker needs to influence the virtual environment destination path so it contains a placeholder name such as __VIRTUAL_NAME__ and a shell-code payload. A path containing the payload but not the placeholder name does not execute commands.

Q: What can be done while patching is unavailable?

Avoid creating or activating environments in paths containing virtualenv template placeholder names, particularly __VIRTUAL_NAME__. Do not source generated activation scripts from untrusted or attacker-controlled directory paths.

Q: How can teams identify potentially affected environments?

Review virtual-environment directory names for template placeholder strings, including __VIRTUAL_NAME__; those names are the condition that enables the demonstrated bash and fish command execution. For csh, a directory named __VIRTUAL_PROMPT_DISPLAY_TCSH__ causes the generated script to fail with an unmatched quote error.

Published Oct 21, 2026

Updated

Impact

ViaTemplateActivator.instantiatetemplate replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment.

VIRTUALNAME holds the environment's directory name, so a destination such as AVIRTUALNAMEB/x'$(touch PWNED)'y is enough. In the default activate for bash, the VIRTUALENV line renders as:

sh VIRTUALENV='/tmp/t/A'x'"'"'$(touch PWNED)'"'"'y'B/x'"'"'$(touch PWNED)'"'"'y'

Sourcing that script runs touch PWNED. The same payload in a path without the placeholder name runs nothing. activate.fish runs the command the same way, and the reporter also showed Python code execution through activate.xsh and bin/activatethis.py. In activate.csh, a directory named after a prompt display placeholder, such as VIRTUALPROMPTDISPLAYTCSH, breaks the script with Unmatched '''.

No change to quote() can stop this, because the rewrite happens after quote() ran; it defeats shlex.quote and repr() alike.

An attacker needs to influence the destination path or --prompt: a CI job or wrapper tool that builds the path from a branch or project name, or a directory in a cloned repository or unpacked archive.

The bug affects versions 20.26.6 through 21.14.1. Version 20.26.6 first quoted template values (#2768) and introduced the per-key loop.

Patches

Fixed in 21.14.2. Activation scripts now keep a placeholder name in the environment's path or prompt as plain text, and activating the example above runs nothing. Fix: https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74

Workarounds

Do not create an environment whose path or --prompt contains a placeholder name such as VIRTUALNAME, VIRTUALENV or VIRTUALPROMPT, and inspect the generated activation script before you source one you did not create.

Credits

Kevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.

Affected Software

1 affected componentFixes available

pip/virtualenv>=20.26.6<=21.14.1

21.14.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/virtualenv to a version that resolves this vulnerability.
Fixed in 21.14.2
Upgrade
Upgrade virtualenv to a version that resolves this vulnerability.
Fixed in 21.14.2
Compensating control
Do not create an environment whose path or --prompt contains placeholder names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__; inspect generated activation scripts before sourcing scripts you did not create.

Event History

Oct 21, 2026

Advisory Published

via GitHub·04:39 PM

Data Sourced

via GitHub·04:39 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is realistically exposed to exploitation?

Users who activate a virtual environment created in a directory whose name is attacker-controlled or otherwise contains a later template placeholder name are exposed. Exploitation requires the user to source or otherwise run an affected activation script.

Are default activation scripts affected?

Yes. The default bash activate script is affected, and the same payload executes through activate.fish. Python code execution was also demonstrated through activate.xsh and bin/activate_this.py.

What does an attacker need to control?

The attacker needs to influence the virtual environment destination path so it contains a placeholder name such as __VIRTUAL_NAME__ and a shell-code payload. A path containing the payload but not the placeholder name does not execute commands.

What can be done while patching is unavailable?

Avoid creating or activating environments in paths containing virtualenv template placeholder names, particularly __VIRTUAL_NAME__. Do not source generated activation scripts from untrusted or attacker-controlled directory paths.

How can teams identify potentially affected environments?

Review virtual-environment directory names for template placeholder strings, including __VIRTUAL_NAME__; those names are the condition that enables the demonstrated bash and fish command execution. For csh, a directory named __VIRTUAL_PROMPT_DISPLAY_TCSH__ causes the generated script to fail with an unmatched quote error.

GHSA-8rjx-v5ww-45pp: OS Command Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to exploitation?

Are default activation scripts affected?

What does an attacker need to control?

What can be done while patching is unavailable?

How can teams identify potentially affected environments?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to exploitation?

Are default activation scripts affected?

What does an attacker need to control?

What can be done while patching is unavailable?

How can teams identify potentially affected environments?