CVE-2026-113722
published 2026-10-20CVE-2026-113722: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted…
PriorityP343high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.29%
20.9th percentile
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user's privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| debian | python-virtualenv | — | — |
| devspaces | udi-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| pypa | virtualenv | < 21.14.9 | 21.14.9 |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-kserve-agent-rhel9 | — | — |
| rhoai | odh-kserve-controller-rhel9 | — | — |
| rhoai | odh-kserve-router-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
| rhoai | odh-ta-lmes-job-rhel9 | — | — |
| rhoai | odh-training-rocm64-torch28-py312-rhel9 | — | — |
| rhoai | odh-trustyai-nemo-guardrails-server-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| satellite | iop-advisor-backend-rhel9 | — | — |
| satellite | iop-host-inventory-rhel9 | — | — |
| satellite | iop-yuptoo-rhel9 | — | — |
| virtualenv | virtualenv | >= 0 < 21.14.9 | 21.14.9 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
virtualenv: virtualenv: arbitrary code execution via improperly quoted interpreter paths in script launchers
vendor_redhat·2026-10-20·CVSS 7.8
CVE-2026-113722 [HIGH] CWE-78 virtualenv: virtualenv: arbitrary code execution via improperly quoted interpreter paths in script launchers
virtualenv: virtualenv: arbitrary code execution via improperly quoted interpreter paths in script launchers
A flaw was found in virtualenv. Due to improper quoting of interpreter paths when generating script wrappers, an attacker who influences the environment destination path can achieve arbitrary code execution. When a user subsequently executes a generated script launcher, embedded shell commands are evaluated with the privileges of that user.
Mitigation: --- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temp
GHSA
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
ghsa·2026-10-21
CVE-2026-113722 [HIGH] CWE-78 virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
## Summary
A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The
app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not
preserve it as literal data in the shell wrapper.
## Affected area
POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper.
Windows executable launchers are not affected by this path.
## Attacker-controlled input
An attacker must influence the environment destination passed to virtualenv, and the user must subsequently run a
generated launcher. The attacker does not need to modify an installed
No detection rules found.
No public exploits indexed.
https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9https://github.com/pypa/virtualenv/pull/3417https://github.com/pypa/virtualenv/releases/tag/21.14.9https://github.com/pypa/virtualenv/security/advisories/GHSA-c978-59m8-c77vhttps://github.com/pypa/virtualenv/security/advisories/GHSA-c978-59m8-c77v
2026-10-20
Published