virtualenv 21.14.2 patches high-severity command injection in activation scripts

The virtualenv project has released version 21.14.2 to address a high-severity command injection vulnerability identified as CVE-2026-113776. This flaw allows attackers to execute arbitrary commands when a user activates a compromised Python virtual environment.

What happened

The vulnerability exists in the `ViaTemplateActivator.instantiate_template` function within pip virtualenv versions 20.26.6 through 21.14.1. According to the GitHub advisory, the function replaces placeholders in activation templates one key at a time across the entire text. When a previously substituted value contains the name of a later placeholder, the subsequent pass rewrites that name inside the quoted literal.

This rewriting process breaks the quoting mechanism, allowing injected values to close outer literals and run as code. The `__VIRTUAL_NAME__` placeholder holds the environment's directory name, making it a primary vector. An attacker can create a directory path such as `A__VIRTUAL_NAME__B/x'$(touch PWNED)'y` to trigger execution.

When the default bash `activate` script sources this environment, the `VIRTUAL_ENV` line renders with broken quotes. This causes the shell to execute the injected command, such as `touch PWNED`. The reporter demonstrated that `activate.fish` runs the command similarly. Python code execution was also shown through `activate.xsh` and `bin/activate_this.py`.

In `activate.csh`, a directory named after a prompt display placeholder like `__VIRTUAL_PROMPT_DISPLAY_TCSH__` breaks the script with an unmatched quote error. Standard quoting functions like `shlex.quote` and `repr()` cannot prevent this because the rewrite happens after quoting occurs.

Why it matters

An attacker needs to influence the destination path or the `--prompt` argument to exploit this flaw. This often occurs in CI jobs or wrapper tools that build paths from branch or project names. Directories in cloned repositories or unpacked archives can also serve as attack vectors if their names are controlled by an adversary.

Version 20.26.6 introduced the per-key loop and first quoted template values, which inadvertently created this condition. The vulnerability persists through version 21.14.1. Without a fix, any user activating an environment with a crafted path or prompt risks code execution on their system.

What to watch

• Monitor for new virtualenv releases addressing template processing flaws
• Check CI pipelines that dynamically generate virtual environment paths
• Review scripts that use `--prompt` arguments with user-controlled input
• Audit existing environments for unusual directory naming patterns

Who needs to act first

Teams should prioritize updating systems where virtual environments are created dynamically from user input. Check whether CI jobs or build tools construct environment paths from branch names or project titles. Roll out the fix to exposed systems first, then test in isolated environments before wider deployment. Back up configuration files before updating to ensure rollback capability if issues arise.

What to do and how to stay safe: virtualenv

• Update pip virtualenv to version 21.14.2 or later on all affected systems
• Review CI pipelines that generate virtual environment paths from user-controlled data
• Audit existing virtual environments for directory names containing template placeholders
• Monitor activation scripts for unexpected command execution or syntax errors

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of virtualenv are affected by CVE-2026-113776?

Versions 20.26.6 through 21.14.1 are vulnerable to this command injection flaw.

How can an attacker exploit this vulnerability?

By crafting environment directory names or prompts that contain template placeholder names, attackers can inject commands that execute when the environment is activated.

Is there a patch available for this vulnerability?

Yes, version 21.14.2 fixes the issue by keeping placeholder names in paths or prompts as plain text.