virtualenv EUVD-2026-106868

Exploitation requires the attacker to control or influence the virtualenv's destination path OR the --prompt value, and that value must literally contain one of the trigger placeholder names (__VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__); a value without a relevant placeholder does not trigger the mechanism. The payload only yields command execution when the victim subsequently activates the environment through bash, fish, xonsh, or via activate_this.py. Limiting factors: user interaction is mandatory (someone must activate the environment), the attacker must have a way to supply the path/prompt (typically only in automation, multi-user, or tooling scenarios - not a normal self-created venv), and the affected version window is 20.26.6 through <21.14.2. The csh-specific token __VIRTUAL_PROMPT_DISPLAY_TCSH__ only breaks the generated script and does NOT achieve command execution, so csh is not a code-execution vector.

CVSS is 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a local attack of low complexity that requires no attacker privileges but does require victim interaction (activating the environment), yielding full confidentiality/integrity/availability impact via command execution (CWE-78). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit was identified, so this is 'no public exploit identified at time of analysis' - note, however, that the fix commit ships adversarial unit tests (e.g. a path 'A__VIRTUAL_NAME__B/x'\$(touch PWNED)'y') that function as a working proof-of-concept of the technique, even if a packaged public exploit is not cataloged here. On balance this is a genuine but conditional flaw rather than a drop-everything emergency: the AV:L vector plus the mandatory preconditions (attacker must influence the destination path or --prompt, that value must contain a trigger placeholder, and a victim must activate the env in bash/fish/xonsh or import activate_this.py) make it non-wormable and non-mass-exploitable, unlike a network-facing RCE. The elevated score is driven by the H/H/H impact, not by ease of large-scale exploitation; realistic targeting is narrow (e.g. CI/automation or tooling that creates venvs at externally supplied paths).

An attacker who can influence where a victim's virtualenv is created (for example automation or a shared workflow that builds a venv at a caller-supplied path) or the --prompt value embeds a template placeholder such as __VIRTUAL_NAME__ alongside a quote-breaking payload in the path/prompt. Because instantiate_template() substitutes placeholders one key at a time, a later pass rewrites that token inside the already-quoted path, closing the literal so that when the victim activates the environment under bash, fish, xonsh, or activate_this.py the remaining payload executes as arbitrary commands. No packaged public exploit is cataloged, but the vendor's fix commit includes a 'touch PWNED' proof-of-concept test demonstrating the technique.