Command Injection Affecting virtualenv package, versions [,21.14.4)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-VIRTUALENV-21282424
- published21 Oct 2026
- disclosed21 Oct 2026
- creditKaya Emre Arikan
Introduced: 21 Oct 2026
NewCVE-2026-113726 (opens in a new tab)How to fix?
Upgrade virtualenv to version 21.14.4 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection via the activate.sh bash activation script, which zsh also sources, when a virtualenv is created with a name containing shell metacharacters such as $(...). Because zsh with PROMPT_SUBST re-expands PS1 on every prompt draw, the unescaped environment name is executed as a shell command each time the prompt is rendered. Prior to 21.13.0 no escaping is applied at all; from 21.13.0 the script escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, leaving zsh users fully exposed.
Note: This is only exploitable when the activation script is sourced in zsh, and the virtualenv name is controlled by an attacker or an untrusted source.