virtualenv CVE-2026-102925

Requires an attacker to control the virtual environment's filesystem path (bash/zsh path) or the interpreter's Tcl/Tk library paths (fish path) with embedded shell metacharacters, AND the victim to source the generated activation script (UI:R). For the bash/zsh vector, there is an additional precondition: the environment must have been relocated such that its recorded directory is absent, forcing the fallback that reaches the vulnerable __VIRTUAL_ENV__ echo. Limiting factors: local access vector (AV:L), mandatory user interaction (sourcing), the specific relocation/absent-directory state for bash/zsh, and shell-specific paths (bash, zsh, or fish activators). Affected only in virtualenv prior to 21.7.13; fixed in 21.7.13.

This is a genuine code-execution flaw (CWE-78 OS command injection) confirmed by the PyPA vendor advisory GHSA-p58f-9548-mpm2 and fixed in virtualenv 21.7.13 (PR #3252, commit 4d5a105). The provided CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8, HIGH) is internally consistent with the description: exploitation is LOCAL (AV:L) and requires the victim to source the activation script (UI:R), yielding full C/I/A impact as arbitrary shell commands run with the sourcing user's privileges. No EPSS score, KEV listing, or public exploit was provided, so exploitation status is 'no public exploit identified at time of analysis' - though the patch's regression tests contain concrete injection payloads (command substitution, backticks, statement separators) that effectively function as a proof-of-concept methodology. Despite the widespread deployment of virtualenv, real-world risk is tempered by the specific and somewhat unusual preconditions (attacker-controlled venv path or Tcl/Tk library path, plus a relocated environment whose recorded directory is absent for the bash/zsh path), making this a real-but-conditional priority rather than a mass-exploitable network vulnerability. No conflicting signals were found: the CVSS local vector matches the description of code execution on sourcing.

An attacker who can influence the filesystem path of a Python virtual environment (e.g., a maliciously named directory in a shared build/CI system, a downloaded/relocated environment, or a crafted Tcl/Tk library path) embeds shell metacharacters that survive the flawed escaping in the generated activate scripts. When a victim later sources the activation script - and, for bash/zsh, the environment has been relocated so its recorded directory is absent - the surplus quotes break out of the data-only quoted run and the metacharacters execute as commands. The fix commit ships regression tests with working payloads (e.g. x'$(id > PWNED)'y), demonstrating the technique.