CVE-2026-115586

Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.9 through 21.14.12

Description The bash bin/activate script fails to properly escape dollar signs and backticks when copying the --prompt value into the PS1 environment variable, provided that promptvars and POSIX mode are disabled during activation. An attacker who controls the --prompt value (which can be sourced from project metadata or tool configurations) can achieve command execution as the user who activates the environment. This occurs if the user subsequently re-enables promptvars (via shopt -s promptvars), enables POSIX mode (via set -o posix), or starts an interactive child bash shell that inherits the exported PS1. In these scenarios, bash expands the command substitution stored in the VIRTUAL ENV PROMPT variable.

Recommendations Update virtualenv to version 21.14.13. As a temporary workaround, set VIRTUAL ENV DISABLE PROMPT=1 before activating the environment to skip the prompt configuration block. Avoid passing untrusted values to the --prompt parameter.