CVE-2026-113725 virtualenv bash activate runs commands from an environment name with a backslash before $
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113725?
CVE-2026-113725 is a high-severity vulnerability in pypa virtualenv, published on 20 Oct 2026.
Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7.
Which versions are affected by CVE-2026-113725?
3 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | All versions | 21.14.7 |
virtualenv PyPI | All versions | 21.14.7 |
virtualenv PyPI | All versions | 21.14.7 |
How do I fix CVE-2026-113725?
Upgrade virtualenv to 21.14.7 or later.
Is CVE-2026-113725 being exploited?
There is no known exploitation of CVE-2026-113725 in the wild and no public exploit code.
Sources
Also known as AZL-110073, AZL-110115, BIT-virtualenv-2026-113725, DEBIAN-CVE-2026-113725, ECHO-a5df-6f8b-cdb4, GHSA-vxj4-q4g9-crj7 and 3 more.