IT SBIT Services
Schneeberger
DEEN
CVE tracker

virtualenv: Command injection via generated POSIX console launchers

CVE-2026-113722High 7.8

← All vulnerabilities

Summary

virtualenv writes console scripts with a /bin/sh launcher whose interpreter path is only partially quoted when the path contains a space or the shebang exceeds 127 bytes. Command substitutions and backticks in the destination path are then executed by the shell. An attacker who can influence the environment destination can run commands with the user's privileges when that user later runs a generated launcher; creating or activating the environment does not trigger it.

Affected

  • pypa virtualenv versions prior to 21.14.9
  • Environments created or modified by affected versions, including pip-installed console scripts that were regenerated by pip's vendored distlib

Fixed in

  • virtualenv 21.14.9 (released 2026-10-17)
  • Existing launchers must be regenerated; upgrading virtualenv alone does not repair them
  • A later pip install or upgrade inside an environment can reintroduce an affected launcher

Workaround

  • Do not create environments in destination paths that other users or untrusted input can influence
  • Recreate existing environments with virtualenv 21.14.9 or later instead of only upgrading the package
  • Re-check launchers after any pip install or upgrade inside an environment

Exploitation

  • CISA SSVC: exploitation status PoC, automatable: no, technical impact: total
  • No evidence of exploitation in the wild found in the research; treat as unknown
  • Trigger requires local influence on the destination path and user execution of a generated launcher

Our recommendation

  • Find virtualenv installations and lockfiles, including those pulled in by tox, pre-commit or similar tools, and pin to 21.14.9 or later
  • Recreate existing environments and verify that launchers are regenerated
  • Re-run this check after pip upgrades inside affected environments
  • Prioritise developer workstations and CI runners that use shared or untrusted project paths

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:33.

Original description (NVD)

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user's privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed