OS Command Injection in py3-virtualenv - CVE-2026-113723
Published: November 9, 2026
Vulnerability identifier: #VU163142
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-113723
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unprivileged attacker to execute arbitrary commands with the privileges of a user activating a virtualenv environment.
The vulnerability exists due to unsafe reinterpretation of prompt or destination arguments during shell prompt expansion after POSIX activation. An unprivileged attacker can supply malicious arguments that execute when the user activates the environment and displays its prompt in dash, a child dash inheriting exported PS1, or Bash running at compatibility level 4.2 or lower.
Affected software
py3-virtualenv
How to mitigate CVE-2026-113723
Install security update from vendor's website.
py3-virtualenv - update to 21.14.9