CVE-2026-113726: virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh receives the raw value. The script assigns that value to PS1. In zsh with PROMPTSUBST, an attacker-influenced environment directory, --prompt, or VIRTUALENVPROMPT value containing command, parameter, or arithmetic expansion syntax can therefore execute commands in the user's shell each time the prompt is drawn. A percent sign is separately interpreted as a zsh prompt escape but does not by itself execute commands. Plain zsh with PROMPTSUBST disabled and bash are not affected by this mechanism. This issue is fixed in version 21.14.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virtualenvto a version that resolves this vulnerability.Fixed in 21.14.4 - Configuration
Disable PROMPT_SUBST to prevent command, parameter, or arithmetic expansion in attacker-influenced prompt values.
zsh PROMPT_SUBST = disabled
Event History
Frequently Asked Questions
Who is exposed to command execution through this issue?
Users who source a vulnerable virtualenv activation script in zsh with the PROMPT_SUBST option enabled are exposed when the environment directory name, --prompt value, or VIRTUALENV_PROMPT value is attacker-influenced. Bash and zsh with PROMPT_SUBST disabled are not affected by this mechanism.
What does an attacker need to control?
The attacker needs to influence the virtual environment directory name, the value passed through --prompt, or VIRTUALENV_PROMPT, and include command, parameter, or arithmetic expansion syntax. The payload executes when the activated shell draws its prompt.
Are percent signs alone sufficient to execute commands?
No. A percent sign is interpreted as a zsh prompt escape, but it does not itself cause command execution.
Which versions need remediation?
Versions before 21.13.0 are affected, as are versions from 21.13.0 through 21.14.4 under the described zsh configuration. The issue is fixed in 21.14.4.
What can be done if upgrading is not immediately possible?
Avoid sourcing affected activation scripts in zsh while PROMPT_SUBST is enabled, especially for environments or prompt values influenced by untrusted sources. Use bash or zsh with PROMPT_SUBST disabled for activation until the fixed version is deployed.