{"id":"CVE-2026-113725","revision":"2e671d4f79ad4ee6ad3db4a0f85abbf9","records":[{"revision":"2e671d4f79ad4ee6ad3db4a0f85abbf9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-113725","aliases":[],"title":"virtualenv bash activate runs commands from an environment name with a backslash before $","description":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \\$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7.","state":0,"publishedAt":"2026-10-20T19:56:52.195+00:00","modifiedAt":"2026-10-21T15:52:26.038+00:00","affected":[{"ecosystem":"Vendor product","name":"virtualenv","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"pypa\",\n                    \"product\": \"virtualenv\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 21.14.7\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7","https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932","https://github.com/pypa/virtualenv/releases/tag/21.14.7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113725","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-113725","identifiers":["CVE-2026-113725"]},"retained":false,"historicalAffected":[]}],"coverage":[]}