CVE-2026-113776

Что произошло

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value's quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": ">= 20.26.6, < 21.14.2"
}

CVSS: оценки и векторы

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Источники и ссылки

{
  "cwes": [
    "cve",
    "nvd"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-10-29T08:14:56.019870+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-29T00:57:57.913685+00:00"
  },
  "scores": [
    "cve",
    "nvd"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-10-29T00:57:57.913685+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-29T00:57:57.913685+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-10-29T08:14:56.019870+00:00"
  },
  "references": [
    "cve",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-29T00:57:57.913685+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены29.10.2026, 11:14
2. Данные обновлены28.10.2026, 20:41
3. Опубликована28.10.2026, 18:29

Личная заметка и статус

Другие CVE того же продукта