CVE-2026-113722: virtualenv command injection via unquoted shebang paths

CVE-2026-113722 · Severity: high · CVSS 7.8 · Published 2026-10-20

virtualenv is a Python tool that creates isolated environments for installing packages. When creating console scripts with interpreter paths containing spaces or special characters, the generated launcher files can expand shell commands and variables if executed. An attacker who controls the environment destination directory can inject commands that run with the user's privileges when the user executes generated scripts.

Technologies: Pypa Virtualenv, virtualenv (PyPI). Vendors: Pypa, PyPI.

Quick answers

Is CVE-2026-113722 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-113722 being exploited in the wild.
How severe is CVE-2026-113722?
High severity, with a CVSS score of 7.8, published 20 October 2026.
Which products and versions are affected?
Pypa Virtualenv before 21.14.9; virtualenv (PyPI) < 21.14.9, ECOSYSTEM:introduced=0,fixed=21.14.9.
Is there a fix for CVE-2026-113722?
Yes. virtualenv (PyPI): upgrade to 21.14.9 or later. Until then: Existing launchers in environments created with vulnerable versions must be regenerated by recreating the virtual environments after upgrading virtualenv. Be aware that later independent pip installations or upgrades can reintroduce affected launchers, as they use pip's own vendored distlib which may remain unchanged. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113722 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-113722?
Check whether you run Pypa Virtualenv or virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • virtualenv (PyPI): upgrade to 21.14.9 or later
    pip install "virtualenv>=21.14.9"

Existing launchers in environments created with vulnerable versions must be regenerated by recreating the virtual environments after upgrading virtualenv. Be aware that later independent pip installations or upgrades can reintroduce affected launchers, as they use pip's own vendored distlib which may remain unchanged.

Technical details

virtualenv's ScriptMakerCustom and pip pass incompletely quoted interpreter paths to distlib's ScriptMaker when generating POSIX console scripts. When paths contain spaces or the shebang exceeds 127 bytes, distlib creates a /bin/sh wrapper with double-quoted interpreter paths that still allow command substitution and backtick expansion. An attacker who influences the environment destination can execute arbitrary commands. The fix requires regenerating existing launchers after upgrading virtualenv, and pip's vendored distlib can reintroduce the vulnerability on later pip install/upgrade operations.

Affected products

  • pypa virtualenv before 21.14.9

Identifiers

  • CVE-2026-113722
  • GHSA-c978-59m8-c77v

Timeline

  • 2026-10-20: disclosed
  • 2026-10-17: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.