CVE-2026-113725: virtualenv bash activate runs commands from an environment name with a backslash before $
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virtualenvto a version that resolves this vulnerability.Fixed in 21.14.7
Event History
Frequently Asked Questions
Which environments are affected?
The issue affects virtualenv versions before 21.14.7 when the Bash activation script is used. The vulnerable behavior is in the handling of the environment name in the shell prompt.
What is required for command execution to occur?
The environment name must contain a backslash before a command-substitution sequence such as \$(...). A user must activate that environment in Bash; the vulnerability has a user-interaction requirement.
When are the embedded commands executed?
The commands run each time Bash draws the prompt after the affected environment has been activated. This can cause repeated command execution during an interactive shell session.
How can the issue be remediated?
Upgrade virtualenv to version 21.14.7, which fixes the Bash prompt escaping issue.