CVE-2026-102925

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.13

Description The generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In bash and zsh scripts, a crafted virtual environment path can reach the VIRTUAL ENV variable when a relocated environment's recorded directory is missing. In the fish script, crafted Tcl or Tk library paths can reach the TCL LIBRARY or TK LIBRARY variables. These surplus quotes can terminate the data-only quoted run, causing shell metacharacters to be parsed as commands when a user sources the activation script, which allows arbitrary code execution with the privileges of that user.

Recommendations Update to version 21.7.13.