SB20261109207 - Multiple vulnerabilities in py3-virtualenv

Description

This security bulletin contains information about 2 vulnerabilities.

1) OS Command Injection (CVE-ID: CVE-2026-113732)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unprivileged local attacker to execute arbitrary commands with the victim's privileges.

The vulnerability exists due to POSIX shell quoting in virtualenv's fish activation script, which mishandles environment paths or prompts containing a backslash before a quote. An unprivileged local attacker can supply a crafted environment path or prompt that triggers command substitution when the victim sources the generated bin/activate.fish script in fish.

2) OS Command Injection (CVE-ID: CVE-2026-113776)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unprivileged local attacker to execute arbitrary code with the privileges of a user activating a virtual environment.

The vulnerability exists due to sequential placeholder substitution in virtualenv activation templates rewriting previously quoted values when an environment path or prompt contains a placeholder name. An unprivileged local attacker can influence that path or prompt to inject code that runs when the victim activates the environment.

Remediation

Install update from vendor's website.

References

• https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q
• https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp