{"id":"CVE-2026-115586","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-115586","summary":"virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into…","details":"virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.","published":"2026-10-23T20:17:21.363","modified":"2026-10-23T20:17:21.363","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4","label":"pypa/virtualenv@3598e20"},"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3466"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.13"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-23T20:17:21.363"}}