{"id":"CVE-2026-115586","revision":"e2075b5e58bb4278ace2dd4b380340dd","records":[{"revision":"e2075b5e58bb4278ace2dd4b380340dd","observedAt":"2026-10-23T21:48:20.592+00:00","statement":{"source":"cve-program","id":"CVE-2026-115586","aliases":[],"title":"virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)","description":"virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.","state":0,"publishedAt":"2026-10-23T19:34:46.391+00:00","modifiedAt":"2026-10-23T20:55:42.764+00:00","affected":[{"ecosystem":"Vendor product","name":"virtualenv","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"pypa\",\n                    \"product\": \"virtualenv\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 21.14.9, < 21.14.13\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc","https://github.com/pypa/virtualenv/pull/3466","https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4","https://github.com/pypa/virtualenv/releases/tag/21.14.13"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115586","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115586","identifiers":["CVE-2026-115586"]},"retained":false,"historicalAffected":[]}],"coverage":[]}