CVE-2026-102937

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.12

Description The BatchActivator.quote() function fails to properly sanitize prompt text before it is inserted into a cmd.exe set statement within the activate.bat file. An attacker capable of influencing the --prompt flag, the VIRTUALENV PROMPT variable, or the related configuration value can inject a double quote to terminate the variable assignment and execute arbitrary commands. These commands run with the privileges of the user who activates the generated Windows environment.

Recommendations Update virtualenv to version 21.7.12 or later.