CVE-2026-113725 pypa CVE debrief

Who should care

Defenders responsible for virtualenv deployments, especially those with untrusted inputs influencing environment names, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who oversee virtualenv usage. They should review the vulnerability's impact on their systems, verify affected versions, and apply necessary patches or mitigations.

Why it matters

CVE-2026-113725 allows for command execution in virtualenv's bash activate script via specially crafted environment names, impacting deployments with untrusted inputs.

• Command execution in bash prompts via specially crafted environment names.
• Potential for lateral movement if environment names are influenced by untrusted inputs.
• Need for verification of affected versions and remediation to prevent exploitation.

Technical summary

The bash `activate` script in virtualenv escapes the environment name for only one of the two passes bash makes over `PS1`, allowing for command execution when a backslash is present in the environment name before $. This vulnerability arises from the script's incomplete handling of backslashes, dollar signs, and backticks in environment names. An attacker can exploit this by influencing the environment name through various means, such as CI jobs, wrapper tools, or directory names in cloned repositories or unpacked archives.

Defensive priority

Defenders should prioritize verifying and remediating affected virtualenv deployments, especially where environment names are influenced by untrusted inputs.

Recommended defensive actions

• Verify virtualenv deployments for affected versions (<= 21.14.6) and update to 21.14.7 or later.
• Review and restrict environment names to prevent influence from untrusted inputs.
• Monitor bash prompts for suspicious activity.
• Implement additional logging and monitoring for environment name inputs.
• Conduct regular security audits of virtualenv deployments.
• Establish a process for rapid patching of vulnerable components.
• Consider using alternative activation scripts or tools.

Evidence notes

The CVE record and source item provide details on the vulnerability in virtualenv's bash activate script, which allows for command execution when a backslash is present in the environment name before $.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.