An attacker who can control the destination path of a virtual environment creation process can force the execution of arbitrary commands under the privileges of the user who subsequently runs the generated launcher. This vulnerability affects systems utilizing virtualenv versions prior to 21.14.9. Notably, simply upgrading the virtualenv package does not remediate existing vulnerable launchers; they must be explicitly regenerated. Furthermore, independent pip operations may reintroduce the flaw due to vendored versions of distlib, requiring consistent environment management practices.

Impact

Successful exploitation allows local command injection when a user executes a generated launcher within a maliciously constructed or influenced environment path. This primarily impacts developers and automated build systems that rely on virtualenv to manage project dependencies on Linux and macOS environments. The scope includes any workflow where an attacker can influence the filesystem structure or environment creation parameters.

Recommendation

• Upgrade virtualenv to version 21.14.9 or later immediately to patch the script generation logic.
• Regenerate all existing virtual environments and associated launchers after applying the patch, as upgrading the base package does not automatically remediate legacy launchers.
• Audit build pipelines and automation scripts that define environment paths to ensure they do not incorporate untrusted or externally influenced input strings that could contain spaces or shell metacharacters.