Fluid Attacks Database

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	virtualenv	>=0 <21.7.12	21.7.12
debian 13	python-virtualenv	=20.31.2+ds-1 \|\| =20.31.2+ds-1+deb13u1 \|\| =20.33.1+ds-1 \|\| =20.34.0+ds-1 \|\| =20.35.3+ds-1 \|\| =20.35.4+ds-1 \|\| =20.36.1+ds-1 \|\| =20.38.0+ds-1 \|\| =21.2.0+ds-1 \|\| =21.2.4+ds-1 \|\| =21.3.1+ds-1 \|\| =21.4.1+ds-1 \|\| =21.5.1+ds-1	-
debian 12	python-virtualenv	=20.17.1+ds-1 \|\| =20.19.0+ds-1 \|\| =20.21.0+ds-1 \|\| =20.23.0+ds-1 \|\| =20.23.0+ds-2 \|\| =20.24.1+ds-1 \|\| =20.24.6+ds-1 \|\| =20.24.6+ds-2 \|\| =20.25.0+ds-1 \|\| =20.25.0+ds-2 \|\| =20.25.1+ds-1 \|\| =20.26.1+ds-1 \|\| =20.26.2+ds-1 \|\| =20.26.6+ds-1 \|\| =20.27.0+ds-1 \|\| =20.28.0+ds-1 \|\| =20.29.1+ds-1 \|\| =20.29.3+ds-1 \|\| =20.30.0+ds-1 \|\| =20.30.0+ds-2 \|\| =20.30.0+ds-3 \|\| =20.31.2+ds-1 \|\| =20.33.1+ds-1 \|\| =20.34.0+ds-1 \|\| =20.35.3+ds-1 \|\| =20.35.4+ds-1 \|\| =20.36.1+ds-1 \|\| =20.38.0+ds-1 \|\| =21.2.0+ds-1 \|\| =21.2.4+ds-1 \|\| =21.3.1+ds-1 \|\| =21.4.1+ds-1 \|\| =21.5.1+ds-1	-
debian 14	python-virtualenv	=20.31.2+ds-1 \|\| =20.33.1+ds-1 \|\| =20.34.0+ds-1 \|\| =20.35.3+ds-1 \|\| =20.35.4+ds-1 \|\| =20.36.1+ds-1 \|\| =20.38.0+ds-1 \|\| =21.2.0+ds-1 \|\| =21.2.4+ds-1 \|\| =21.3.1+ds-1 \|\| =21.4.1+ds-1 \|\| =21.5.1+ds-1	-
rpm rhel8	python-36	-	-

Aliases

1. CVE-2026-1029372. NVD-2026-1029373. OSV-2026-1029374. OSV-DEBIAN-2026-1029375. GHSA-x78j-v8h9-3j2q6. GCVE-2026-1029377. SECURITY-TRACKER-CVE-2026-102937

References

1. https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q2. https://github.com/pypa/virtualenv/pull/32503. https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea64. https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4014.yaml5. https://github.com/pypa/virtualenv/releases/tag/21.7.126. https://pypi.org/project/virtualenv

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.