OS Command Injection in py3-virtualenv - CVE-2026-113726
Published: November 9, 2026
Vulnerability identifier: #VU163140
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-113726
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unprivileged local attacker to execute arbitrary commands with the privileges of a user activating a virtual environment.
The vulnerability exists due to insufficient escaping of environment names in virtualenv's bash activation script when zsh expands PS1 with the non-default PROMPT_SUBST option enabled. An unprivileged local attacker can influence the environment directory name or prompt value to inject commands that execute whenever the prompt is displayed after the victim sources bin/activate.
Affected software
py3-virtualenv
Anolis OS
python3-virtualenv
python3-virtualenv-doc
Anolis OS
python3-virtualenv
python3-virtualenv-doc
How to mitigate CVE-2026-113726
Install security update from vendor's website.
py3-virtualenv - update to 21.14.4
python3-virtualenv - update to 20.28.0-4
python3-virtualenv-doc - update to 20.28.0-4
python3-virtualenv - update to 20.28.0-4
python3-virtualenv-doc - update to 20.28.0-4