CVE-2026-113776 — virtualenv activation scripts run code from a path that contains a placeholder name

virtualenv's ViaTemplateActivator.instantiate_template processes activation-template placeholders one at a time. If an already substituted and quoted value contains the name of a later placeholder, that name is rewritten inside the quoted literal and the rest of the path can run as code when the environment is activated. Versions 20.26.6 through 21.14.1 are affected; the issue is fixed in 21.14.2.