ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-113722

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

Published Oct 20, 2026 · catalog updated Oct 23, 2026 · virtualenv: Generated POSIX console

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-113722. EPSS is 0.29%. Act only if a listed version of virtualenv: Generated POSIX console is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (virtualenv: Generated POSIX console).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.29%
Remediation
Version ranges on file
Affected products
pip virtualenv

## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. ## Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. ## Attacker-controlled input An attacker must influence the environment destination passed to virtualenv, and the user must subsequently run a generated launcher. The attacker does not need to modify an installed executable or control the user's app-data cache. ## Affected code The relevant 21.14.8 source is in [ScriptMakerCustom](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/seed/embed/via_app_data/pip_install/base.py). ## Mechanism The app-data seeder passes the environment's interpreter path through to distlib's . It adds double quotes for a path with a space but does not escape shell expansions inside those quotes. When the path has a space or the shebang exceeds 127 bytes, distlib emits a wrapper with a line shaped like . The shell expands and backticks in that path when the launcher is run. The same wrapper must also parse as Python, which exposes additional quote and backslash cases. Environment creation and activation do not trigger the shell payload. ## Reproduction and evidence The scanner created three environments: a control under , one under , and one under a path of more than 127 bytes ending in . Each was created without producing . Running the generated created in both attack cases; the control created none. The long-path case reached the shell wrapper without a space. This reproduces execution by the generated launcher, with the user's privileges, rather than during seeding. The report dates the app-data seeder's dist

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • pip virtualenv< 21.14.9

How to fix CVE-2026-113722

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-113722. EPSS is 0.29%. Act only if a listed version of virtualenv: Generated POSIX console is installed.

Which versions are affected?

Compare what you have installed with < 21.14.9. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-78: OS Command Injection. EPSS 0.29%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · GitHub Advisory Database

    Detected

    ## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. ## Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter

  2. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. ## Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter

  3. Oct 22, 2026 · NIST NVD

    Updated

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands comma

  4. Oct 23, 2026 · NIST NVD

    Updated

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands comma

Sources

  • CVE.orgVulnerability recordCVE-2026-113722

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-113722

    30-day exploitation probability 0.29%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-c978-59m8-c77v

    virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

    github.com
  • NIST NVDVulnerability recordCVE-2026-113722

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a

    nvd.nist.gov

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 6, 2026
  • NIST NVDOct 23, 2026
  • CVE.orgOct 23, 2026
  • GitHub Advisory DatabaseOct 22, 2026