{"id":"DEBIAN-CVE-2026-113776","details":"virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value's quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2.","modified":"2026-10-23T18:05:10.596327236Z","published":"2026-10-20T22:19:30.557Z","upstream":["CVE-2026-113776"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-113776"}],"affected":[{"package":{"name":"python-virtualenv","ecosystem":"Debian:12","purl":"pkg:deb/debian/python-virtualenv?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.17.1+ds-1","20.19.0+ds-1","20.21.0+ds-1","20.23.0+ds-1","20.23.0+ds-2","20.24.1+ds-1","20.24.6+ds-1","20.24.6+ds-2","20.25.0+ds-1","20.25.0+ds-2","20.25.1+ds-1","20.26.1+ds-1","20.26.2+ds-1","20.26.6+ds-1","20.27.0+ds-1","20.28.0+ds-1","20.29.1+ds-1","20.29.3+ds-1","20.30.0+ds-1","20.30.0+ds-2","20.30.0+ds-3","20.31.2+ds-1","20.33.1+ds-1","20.34.0+ds-1","20.35.3+ds-1","20.35.4+ds-1","20.36.1+ds-1","20.38.0+ds-1","21.2.0+ds-1","21.2.4+ds-1","21.3.1+ds-1","21.4.1+ds-1","21.5.1+ds-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113776.json"}},{"package":{"name":"python-virtualenv","ecosystem":"Debian:13","purl":"pkg:deb/debian/python-virtualenv?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.31.2+ds-1","20.31.2+ds-1+deb13u1","20.33.1+ds-1","20.34.0+ds-1","20.35.3+ds-1","20.35.4+ds-1","20.36.1+ds-1","20.38.0+ds-1","21.2.0+ds-1","21.2.4+ds-1","21.3.1+ds-1","21.4.1+ds-1","21.5.1+ds-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113776.json"}},{"package":{"name":"python-virtualenv","ecosystem":"Debian:14","purl":"pkg:deb/debian/python-virtualenv?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.31.2+ds-1","20.33.1+ds-1","20.34.0+ds-1","20.35.3+ds-1","20.35.4+ds-1","20.36.1+ds-1","20.38.0+ds-1","21.2.0+ds-1","21.2.4+ds-1","21.3.1+ds-1","21.4.1+ds-1","21.5.1+ds-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113776.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}