CVE-2026-113725

In virtualenv from 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.

In virtualenv from 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the activation template, allowing trigger names such as __VIRTUAL_NAME__ inside an already substituted path to be replaced again. This can lead to command execution when activating the environment via bash, fish, xonsh, or activate_this.py if an attacker influences the destination path or --prompt.

In virtualenv prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can terminate the fish literal and execute command substitution when the user sources activate.fish.

In virtualenv prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value assigned to PS1. In zsh with PROMPT_SUBST, an attacker-influenced value containing expansion syntax can execute commands each time the prompt is drawn.

In virtualenv before 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can cause a victim-owned target outside the destination to become broadly writable.

virtualenv is a tool for creating isolated virtual Python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.

Prior to 21.14.9, virtualenv incompletely quotes the interpreter path when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks, allowing command execution with the user's privileges when the generated launcher is later run.

In virtualenv before 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account can cause files outside the requested tree to be created or overwritten.

In virtualenv before 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can produce files writable by another local account in a later traversable environment.

In virtualenv before 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause files outside the environment to be deleted.