CVE-2026-113722: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in pypa virtualenv

The vulnerability in virtualenv (prior to 21.14.9) involves improper neutralization of special elements in OS command construction (CWE-78). Specifically, when generating POSIX console scripts, the interpreter path passed to distlib ScriptMaker is incompletely quoted. If the path contains spaces or results in a shebang longer than 127 bytes, distlib creates a /bin/sh wrapper script with a double-quoted interpreter path that still allows shell command substitutions and backticks to be expanded. An attacker who can influence the environment destination can exploit this to execute arbitrary commands with the privileges of the user running the launcher. The vulnerability does not trigger during environment creation or activation but only when the generated launcher is executed. Upgrading virtualenv to version 21.14.9 fixes the issue, but existing launchers remain vulnerable until regenerated. Additionally, pip's vendored distlib remains unchanged, so pip upgrades can reintroduce the vulnerability by generating affected launchers.

Successful exploitation allows an attacker who can influence the environment destination to execute arbitrary OS commands with the privileges of the user running the generated launcher script. This can lead to full compromise of the user's environment, including confidentiality, integrity, and availability impacts. The vulnerability does not require elevated privileges to exploit but does require user interaction to run the affected launcher. Existing launchers remain vulnerable even after upgrading virtualenv, requiring regeneration. Pip upgrades can reintroduce the vulnerability.

A fix for this vulnerability is available in virtualenv version 21.14.9. Users should upgrade to this version or later. However, simply upgrading virtualenv does not repair existing launchers; these must be regenerated to remove the vulnerability. Users should also be aware that pip's vendored distlib remains vulnerable, so pip upgrades or installations can reintroduce affected launchers. Therefore, after upgrading virtualenv, users should regenerate all launchers and monitor pip-related activities to avoid reintroducing the issue.