CVE-2026-113723 — virtualenv: Bash prompt values can change meaning under older compatibility modes
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt.…
Published: 2026-10-20 · CVSS: 7.1 · CVSS 4.0
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7