{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/virtualenv--21.14.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pypa:virtualenv:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-113722"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["virtualenv (\u003c 21.14.9)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","python","command-injection"],"_cs_type":"advisory","_cs_vendors":["Python Packaging Authority"],"content_html":"\u003cp\u003eThe virtualenv tool, used for creating isolated Python environments, contains a command injection vulnerability (CVE-2026-113722) resulting from improper quoting of interpreter paths. When virtualenv or pip utilizes distlib to generate POSIX console scripts, specific conditions involving interpreter path strings - specifically those containing spaces or triggering shebangs exceeding 127 bytes - cause distlib to generate a /bin/sh wrapper. This wrapper fails to sufficiently quote the interpreter path, permitting the evaluation of command substitutions and backticks contained within the path.\u003c/p\u003e\n\u003cp\u003eAn attacker who can control the destination path of a virtual environment creation process can force the execution of arbitrary commands under the privileges of the user who subsequently runs the generated launcher. This vulnerability affects systems utilizing virtualenv versions prior to 21.14.9. Notably, simply upgrading the virtualenv package does not remediate existing vulnerable launchers; they must be explicitly regenerated. Furthermore, independent pip operations may reintroduce the flaw due to vendored versions of distlib, requiring consistent environment management practices.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows local command injection when a user executes a generated launcher within a maliciously constructed or influenced environment path. This primarily impacts developers and automated build systems that rely on virtualenv to manage project dependencies on Linux and macOS environments. The scope includes any workflow where an attacker can influence the filesystem structure or environment creation parameters.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade virtualenv to version 21.14.9 or later immediately to patch the script generation logic.\u003c/li\u003e\n\u003cli\u003eRegenerate all existing virtual environments and associated launchers after applying the patch, as upgrading the base package does not automatically remediate legacy launchers.\u003c/li\u003e\n\u003cli\u003eAudit build pipelines and automation scripts that define environment paths to ensure they do not incorporate untrusted or externally influenced input strings that could contain spaces or shell metacharacters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:56:26Z","date_published":"2026-10-20T21:56:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-virtualenv-command-injection/","summary":"A command injection vulnerability in virtualenv prior to 21.14.9 allows arbitrary code execution via malformed interpreter paths when generating POSIX console scripts.","title":"Python virtualenv: POSIX console script command injection (CVE-2026-113722)","url":"https://feed.craftedsignal.io/briefs/2026-10-virtualenv-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Virtualenv (\u003c 21.14.9)","version":"https://jsonfeed.org/version/1.1"}