Am I affected by virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax? What should I do?
A destination path supplied to virtualenv can be read as shell syntax by a generated POSIX console launcher.
Affected: virtualenv < 21.14.9. Fixed in: 21.14.9. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-113722-virtualenv (opens external site)
1 answer
Am I affected? Affected: virtualenv < 21.14.9. Fixed in: 21.14.9.
- Check your version: run
pip show virtualenv. Versions < 21.14.9 of virtualenv are affected.
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "virtualenv>=21.14.9"(first patched version 21.14.9). - Recreate environments with the corrected virtualenv to regenerate the launchers.
- Use an environment destination chosen by a trusted user.
- For older releases, avoid generating environments at destinations derived from untrusted input.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-c978-59m8-c77v (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-113722-virtualenv (opens external site)
Did this work for you?- Check your version: run