CVE-2026-113723

— UNSCOREDpublic exploit available

Published 2026-10-20 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

Weaknesses

CWE-78

Public exploit & PoC references

https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
https://github.com/pypa/virtualenv/pull/3418
https://github.com/pypa/virtualenv/releases/tag/21.14.9
https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp

All references

https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
https://github.com/pypa/virtualenv/pull/3418
https://github.com/pypa/virtualenv/releases/tag/21.14.9
https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2020-37279PoC
CRITICALCVE-2020-37282PoC
HIGHCVE-2022-51019PoC
CRITICALCVE-2024-4457PoC
HIGHCVE-2025-14754
CRITICALCVE-2025-71429PoC
UNSCOREDCVE-2026-0313
UNSCOREDCVE-2026-0320

Related by shared AI tags and CWE weakness class. Browse the full archive.