virtualenv EUVD-2026-105304

Exploitation requires an attacker to influence the virtualenv environment destination path so that it (a) contains a space or tab, or produces a shebang longer than 127 bytes - which forces distlib/virtualenv to emit a /bin/sh wrapper - AND (b) contains POSIX shell command-substitution syntax such as $(...) or backticks that the double-quoted interpreter path still expands. The flaw affects only POSIX console-script launchers (Windows is explicitly excluded in the regression tests) generated by virtualenv's ScriptMakerCustom and pip seeding prior to 21.14.9. Limiting factors that reduce real-world risk: the victim must actively run a generated launcher (creation and activation do NOT trigger it), the attacker needs local control over the destination path, and the issue is confined to POSIX systems. Additionally, upgrading alone is insufficient - existing launchers must be regenerated, and a later independent pip install can reintroduce the vulnerable launcher.

All signals point to a genuine but conditionally-gated local code-execution flaw rather than a mass-exploitation emergency. The NVD CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: exploitation is local (the attacker must influence the virtualenv destination path), requires no privileges on the target, but depends on user interaction because the injected command only fires when the victim later runs a generated console-script launcher. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of in-the-wild abuse. The CWE-78 classification (OS command injection) aligns with the root cause - a double-quoted interpreter path in the /bin/sh wrapper that still expands $(...) and backticks. The realistic priority is moderate: this is not a remotely-triggerable network bug and the attacker must already be able to control where an environment is created (e.g. a shared build path, an attacker-controlled CI checkout directory, or a malicious project layout), which narrows it toward targeted or supply-chain scenarios rather than broad exploitation. One nuance defenders must weigh: PR:N means 'no authentication,' but practically the attacker needs write influence over the destination path, so treat the 'unauthenticated' label as a CVSS artifact rather than evidence of trivial remote abuse.

An attacker influences the filesystem path where a virtualenv is created - for example a shared or attacker-controlled directory name on a POSIX CI runner - such that the path contains a space (or produces a shebang longer than 127 bytes) together with shell command-substitution syntax like $(...) or backticks. virtualenv/pip then generate a /bin/sh console-script launcher whose double-quoted interpreter path still expands that substitution, so when the user later invokes the launcher the injected command runs with the user's privileges. No public exploit code was identified, and neither environment creation nor activation triggers the payload - only running a generated launcher does.