BIT-virtualenv-2026-113723

    Dashboard / Vulnerabilities / BIT-virtualenv-2026-113723

    BIT-virtualenv-2026-113723

    Published: 29 Oct 2026Last Modified: 29 Oct 2026

    Summary: virtualenv: Bash prompt values can change meaning under older compatibility modes

    Details: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

    References: https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22, https://github.com/pypa/virtualenv/pull/3418, https://github.com/pypa/virtualenv/releases/tag/21.14.9, https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp, https://nvd.nist.gov/vuln/detail/CVE-2026-113723

    Affected packages

    Package

    Name: virtualenv

    Purl: pkg:bitnami/virtualenv

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -21.14.9

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High