{"answers":{"affected":"3 open source packages ship an affected version, including virtualenv.","exploited":"There is no known exploitation of CVE-2026-113776 in the wild and no public exploit code.","fix":"Upgrade virtualenv to 21.14.2 or later.","what":"CVE-2026-113776 is a high-severity vulnerability in pypa virtualenv, published on 20 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-113776 and fix it if it is affected.\n\nWhat it is: CVE-2026-113776 is a high-severity vulnerability in pypa virtualenv, published on 20 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-113776 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- virtualenv (Bitnami): affected from 20.26.6; fixed in 21.14.2\n- virtualenv (PyPI): affected from 20.26.6; fixed in 21.14.2\n- virtualenv (PyPI): affected from 20.26.6; fixed in 21.14.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-113776/ (Markdown: https://insights.sbomify.com/CVE-2026-113776/index.md)","id":"CVE-2026-113776","markdown":"https://insights.sbomify.com/CVE-2026-113776/index.md","name":"CVE-2026-113776","record":{"aliases":["AZL-110106","BIT-virtualenv-2026-113776","DEBIAN-CVE-2026-113776","ECHO-d6de-17d8-f721","GHSA-8rjx-v5ww-45pp","MINI-3g6q-9gwh-55hg","ROOT-APP-PYPI-CVE-2026-113776","UBUNTU-CVE-2026-113776"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"description":"virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value's quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2.","ecosystems":["Bitnami","PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"virtualenv activation scripts run code from a path that contains a placeholder name","id":"CVE-2026-113776","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":null,"year":"2026"},"n_packages":3,"n_references":3,"next":{"headline":"pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission","id":"CVE-2026-113779"},"packages":[{"ecosystem":"Bitnami","fixed":["21.14.2"],"introduced":["20.26.6"],"last_affected":[],"package":"virtualenv","purl":"pkg:bitnami/virtualenv","source":"BIT-virtualenv-2026-113776"},{"ecosystem":"PyPI","fixed":["21.14.2"],"introduced":["20.26.6"],"last_affected":[],"package":"virtualenv","purl":null,"source":"GHSA-8rjx-v5ww-45pp"},{"ecosystem":"PyPI","fixed":["21.14.2"],"introduced":["20.26.6"],"last_affected":[],"package":"virtualenv","purl":"pkg:pypi/virtualenv","source":"GHSA-8rjx-v5ww-45pp"}],"prev":{"headline":"Dynamic Library Loading Process Control in Autodesk Fusion Desktop","id":"CVE-2026-113775"},"products":["virtualenv"],"published":"2026-10-20","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-28","vendors":["pypa"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-113776/"}