Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-102925 high CVSS 7.8

OS Command Injection in virtualenv (CVE-2026-102925)

Summary

OS command injection in virtualenv (CVE-2026-102925). Successful exploitation can lead to full system takeover. Exploitable via activate. Mitigation: upgrade to 21.7.13 or later.

Original description

The description as published by the source.

Impact

The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.

activate is affected through the virtual environment's own path, on the branch that reports a relocated environment:

echo "Virtual environment directory __VIRTUAL_ENV__ does not exist!" >&2

For a destination named x'$(id)'y, shlex.quote emits 'x'"'"'$(id)'"'"'y'. The inner " closes the enclosing double quote and $(id) is left unquoted. Backtick and ; payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.

activate.fish is affected through the interpreter's Tcl/Tk library paths:

set -gx TCL_LIBRARY '__TCL_LIBRARY__'

shlex.quote already returns '/tcl/(cmd)/lib', so the rendered line is ''/tcl/(cmd)/lib''. fish concatenates the adjacent quoted runs and expands the (cmd) left between them. The same doubling also splits a path containing a space into two list elements, corrupting TCL_LIBRARY and TK_LIBRARY.

This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered activate.bat.

Patches

Fixed in 21.7.13 by moving the placeholders outside…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-102925 has been found in virtualenv.
Attackers can target a specific entry point like activate over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 7.8/10.
What to do: upgrade virtualenv to 21.7.13 or later.
If unsure, ask your IT team or search "virtualenv CVE-2026-102925" on the vendor's site.

CVE-2026-102925 (virtualenv) — CWE-78 / CVSS v3 7.8
Attack vector: local / unauthenticated
Attack surface: activate / activate.fish / shlex.quote / TCL_LIBRARY
Patched: 21.7.13 — apply immediately
Workaround: Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

OS command injection (CWE-78) exists in virtualenv. Attackers reach the vulnerable code path via activate without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of virtualenv. Attack surface: activate / activate.fish / shlex.quote / TCL_LIBRARY.

🔥 Severity

Severity: High (CVSS 7.8/10). Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to 21.7.13.

🛡️ Workaround

Workaround: Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'virtualenv' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'virtualenv' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で virtualenv を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply temporary workaround mitigate 
    Avoid creating or distributing virtual environments whose path contains `'`, `` ` ``, `$`, `;`, `(` or `)`, and inspect the generated activation script before sourcing one you did not create.

    パッチが適用されるまでの応急処置として、Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade virtualenv to 21.7.13

    ステージング環境で 21.7.13 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

pip virtualenv
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.7.13"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details