CVE-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113723?
CVE-2026-113723 is a high-severity vulnerability in pypa virtualenv, published on 20 Oct 2026.
Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
Weakness: CWE-78
Which versions are affected by CVE-2026-113723?
3 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | All versions | 21.14.9 |
virtualenv PyPI | All versions | 21.14.9 |
virtualenv PyPI | All versions | 21.14.9 |
How do I fix CVE-2026-113723?
Upgrade virtualenv to 21.14.9 or later.
Is CVE-2026-113723 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113723 exists.
Sources
Also known as AZL-110079, AZL-110097, BIT-virtualenv-2026-113723, DEBIAN-CVE-2026-113723, ECHO-2c36-be90-38e4, GHSA-6w3r-xr62-4xcp and 3 more.