CVE-2026-113723: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in pypa virtualenv
Description
CVE-2026-113723 is an OS command injection vulnerability in pypa virtualenv prior to version 21.14.9. The issue arises because caller-supplied prompt text can be interpreted as executable syntax in the bash activation prompt. Exploitation requires an attacker to control the value passed to virtualenv and a user to activate the environment and view the prompt. This vulnerability is fixed in version 21.14.9.
CVSS v4.0
Score 7.1high
Affected software
pypa
virtualenv
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in pypa virtualenv (CVE-2026-113723) involves improper neutralization of special elements used in an OS command (CWE-78). Specifically, before version 21.14.9, the prompt text supplied by the caller can be executed as bash syntax during environment activation. An attacker must influence the prompt text passed to virtualenv, and a user must activate the environment for the malicious code to execute. This flaw allows potential command injection via the bash activation prompt. The issue is resolved in virtualenv version 21.14.9.
Potential Impact
If exploited, this vulnerability could allow an attacker to execute arbitrary commands in the context of the user activating the virtual environment. However, exploitation requires both attacker control over the prompt text passed to virtualenv and user interaction to activate the environment and trigger the prompt. The CVSS 4.0 score is 7.1 (high severity), reflecting the complexity and required user interaction.
Mitigation Recommendations
Upgrade virtualenv to version 21.14.9 or later, where this vulnerability is fixed. No other mitigation steps are indicated or required according to the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T16:03:14.863Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad7c9302cdf04f656591b16
Added to database: 10/20/2026, 20:04:00 UTC
Last enriched: 10/20/2026, 20:18:15 UTC
Last updated: 10/20/2026, 20:19:54 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.