AIKIDO-2026-785880
virtualenv is vulnerable to OS Command Injection
78
CVE Score
High
OS Command Injection
TL;DR
BatchActivator.quote() returns its input unchanged, the only shell activator with no escaping at all. --prompt, the VIRTUALENV_PROMPT environment variable, and the config file all set the prompt, and activate.bat writes it directly into an @set "VAR=value" line, so a prompt containing a double quote closes that string early and the remainder runs as live cmd.exe syntax. Activating the resulting environment on Windows then executes the injected commands in the user's shell. The fix escapes the characters cmd.exe treats as live syntax inside this construct.
How do I fix this?
Upgrade the virtualenv library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your --prompt value, the VIRTUALENV_PROMPT environment variable, or your config file's prompt setting comes from an untrusted or externally influenced source, and the resulting environment is activated on Windows.
Package
Versions
1.0.0 - 21.7.11
Fixed in 21.7.12Background info
virtualenv is vulnerable to OS Command Injection in versions 1.0.0 - 21.7.11.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.