CVE-2026-113725: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in pypa virtualenv

The vulnerability exists in the bash activate script of pypa virtualenv before version 21.14.7. The script escapes the environment name for only one of the two passes bash makes over the PS1 prompt variable. If the environment name contains a backslash followed by command substitution syntax (e.g., \$(...)), the escaping is undone, causing the commands to be executed each time bash draws the prompt. This constitutes an OS command injection (CWE-78) due to improper neutralization of special elements in the environment name. The issue is resolved in version 21.14.7.

An attacker who can control or influence the environment name can inject arbitrary commands that execute in the user's shell prompt, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score is 7.8 (high), reflecting local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade pypa virtualenv to version 21.14.7 or later, where the vulnerability is fixed. Since this is a client-side tool, users should apply the official patch to prevent command injection via environment names in the bash activate script.