CVE-2026-113718: high-severity vulnerability in pypa virtualenv
virtualenv: Xonsh activation literals depend on the script decoding codec
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.2%
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
pypa · virtualenvRelated CVEs — pypa virtualenv
In the same product, most dangerous first.
CVE-2026-113726HIGHvirtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTEPSS 0.3%CVE-2026-113717LOWvirtualenv: Pip seeding with download omits wheel digest verificationEPSS 0.3%CVE-2026-113722HIGHvirtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxEPSS 0.3%CVE-2026-115586HIGHvirtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)EPSS 0.3%CVE-2026-113776HIGHvirtualenv activation scripts run code from a path that contains a placeholder nameEPSS 0.3%CVE-2026-113725HIGHvirtualenv bash activate runs commands from an environment name with a backslash before $EPSS 0.3%