CVE-2026-113776: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in pypa virtualenv

The vulnerability in pypa virtualenv versions >=20.26.6 and <21.14.2 involves improper neutralization of special elements used in OS commands (CWE-78). The ViaTemplateActivator.instantiate_template() method replaces placeholders one key at a time in activation templates. If an attacker can influence the destination path or the --prompt argument with specially crafted values containing placeholders such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__, the quoting of these values can be prematurely closed during substitution. This allows execution of arbitrary OS commands when the environment is activated via bash, fish, xonsh, or activate_this.py scripts. The csh shell prompt token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can break the script but does not lead to command execution. The vulnerability is resolved in version 21.14.2.

Successful exploitation can lead to arbitrary code execution with the privileges of the user activating the virtual environment. The vulnerability affects confidentiality, integrity, and availability (all rated high). Exploitation requires user interaction and control over environment path or prompt values. No known exploits in the wild have been reported.

Upgrade virtualenv to version 21.14.2 or later, where this vulnerability is fixed. Until then, avoid using untrusted input in the destination path or --prompt parameters when creating or activating virtual environments. No other vendor mitigations or temporary fixes are documented.