SB20261109210 - Multiple vulnerabilities in py3-virtualenv

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109210

SB20261109210 - Multiple vulnerabilities in py3-virtualenv

Published: November 9, 2026

Security Bulletin ID SB20261109210
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 18% Medium 36% Low 45%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2026-113723)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged attacker to execute arbitrary commands with the privileges of a user activating a virtualenv environment.

The vulnerability exists due to unsafe reinterpretation of prompt or destination arguments during shell prompt expansion after POSIX activation. An unprivileged attacker can supply malicious arguments that execute when the user activates the environment and displays its prompt in dash, a child dash inheriting exported PS1, or Bash running at compatibility level 4.2 or lower.


2) Code Injection (CVE-ID: CVE-2026-113718)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an attacker who controls virtualenv argument data to execute commands with the activating user's privileges.

The vulnerability exists due to encoding-dependent quoting in virtualenv's POSIX xonsh activation script when UTF-8 output is decoded using a legacy multibyte encoding such as GBK. An attacker who controls virtualenv argument data can supply a malicious prompt or destination value that escapes its string literal when a user subsequently sources activate.xsh.


3) OS Command Injection (CVE-ID: CVE-2026-113722)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to execute commands with the privileges of a user running a generated virtualenv launcher.

The vulnerability exists due to insufficient quoting of destination-derived interpreter paths in POSIX console launchers when spaces or long shebangs require a shell wrapper. An unprivileged local attacker can influence the environment destination to include shell substitutions that execute when the user subsequently runs the generated launcher.


4) Link following (CVE-ID: CVE-2026-113721)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged local attacker to create or overwrite files outside the requested virtual environment with the invoking user's permissions.

The vulnerability exists due to improper link resolution in virtualenv's activation and configuration writers during environment creation. A low-privileged local attacker can prepare destination file links before a user creates an environment, redirecting generated content to targets writable by that user.


5) Link following (CVE-ID: CVE-2026-113724)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged local attacker to change permissions on a victim-owned file outside the virtual environment destination.

The vulnerability exists due to virtualenv's deletion-recovery handler following symlinks when changing permissions after a failed removal. A low-privileged local attacker can supply a symlink inside a read-only directory and have a non-root victim run virtualenv on it, changing a victim-owned target that lacks owner-write permission to mode 0777.


6) Path traversal (CVE-ID: CVE-2026-113719)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker with low privileges to delete files and directories outside a virtual environment using the invoking user's permissions.

The vulnerability exists due to missing path containment checks in virtualenv's app-data seeder when removing previously installed seed packages during environment reuse. A local attacker with low privileges can plant traversal entries in existing package metadata so that a victim reseeding the environment deletes targeted paths they have permission to remove.


7) Improper validation of integrity check value (CVE-ID: CVE-2026-113714)

CWE-ID: CWE-354 - Improper Validation of Integrity Check Value

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a malicious package-index operator to execute code as a victim who later runs pip in a newly created environment.

The vulnerability exists due to virtualenv caching downloaded wheels before verification and selecting the verification target from index-influenced pip output. A malicious package-index operator can supply a modified wheel and forge output naming a known genuine local wheel when the victim updates seed wheels using that configured index with PyPI digest comparison enabled, causing the modified wheel to be accepted and reused.


8) Link following (CVE-ID: CVE-2026-113716)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged local attacker to place or replace environment files outside the selected destination using the invoking user's permissions.

The vulnerability exists due to virtualenv's builtin creator accepting existing directory symlinks when preparing a previously populated environment destination. A low-privileged local attacker can plant links beneath that destination before the user creates an environment, redirecting generated files into directories writable by the user but not necessarily the attacker.


9) Download of code without integrity check (CVE-ID: CVE-2026-113717)

CWE-ID: CWE-494 - Download of Code Without Integrity Check

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an attacker controlling the configured package index to execute code as a user who later invokes pip in a seeded environment.

The vulnerability exists due to missing wheel digest verification in virtualenv's pip seeder when both --seeder pip and --download are selected. An attacker controlling the configured package index can serve a modified same-version pip wheel through an index configured in pip.conf, causing its installation without comparison against PyPI metadata.


10) CRLF injection (CVE-ID: CVE-2026-113715)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an untrusted caller to alter virtual environment settings and weaken environment isolation.

The vulnerability exists due to virtualenv interpreting line-boundary characters in destination paths as configuration boundaries when reading pyvenv.cfg with the non-default venv creator. An untrusted caller can supply a crafted destination path to inject home and include-system-site-packages settings, changing the interpreter's home directory and enabling access to system packages.


11) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-113720)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unprivileged local attacker to execute code as the environment owner.

The vulnerability exists due to virtualenv's app-data copy seeder preserving cached file permissions instead of applying the current umask when creating a new environment. An unprivileged local attacker can modify seeded pip files when the cache was populated under a permissive umask and destination directories are traversable, causing injected code to run when the owner invokes pip.


Remediation

Install update from vendor's website.

References