AIKIDO-2026-785880
virtualenv is vulnerable to OS Command Injection
78
High Risk
This Affects:
virtualenvTL;DR
BatchActivator.quote() returns its input unchanged, the only shell activator with no escaping at all. --prompt, the VIRTUALENV_PROMPT environment variable, and the config file all set the prompt, and activate.bat writes it directly into an @set "VAR=value" line, so a prompt containing a double quote closes that string early and the remainder runs as live cmd.exe syntax. Activating the resulting environment on Windows then executes the injected commands in the user's shell. The fix escapes the characters cmd.exe treats as live syntax inside this construct.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your --prompt value, the VIRTUALENV_PROMPT environment variable, or your config file's prompt setting comes from an untrusted or externally influenced source, and the resulting environment is activated on Windows.
Background info
virtualenv is vulnerable to OS Command Injection in versions 1.0.0 - 21.7.11.
How to fix this
Upgrade the virtualenv library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.