Bash Script Vulnerability in Virtualenv Affects Python Environments

CVE-2026-115586

What is CVE-2026-115586?

A flaw in the bash activation script of Virtualenv versions 21.14.9 to 21.14.12 allows for unauthenticated command execution. When users activate a virtual environment with specific conditions, an attacker can exploit this vulnerability by injecting arbitrary commands through a user-controlled --prompt parameter. This scenario occurs if both promptvars are disabled and the POSIX mode is off. The issue was rectified in version 21.14.13, ensuring that all dollar signs and backticks are properly escaped, thus preventing unintended command execution.

References