Vulnerability-Lookup

URL	Tags
https://github.com/pypa/virtualenv/security/advis…	x_refsource_CONFIRM
https://github.com/pypa/virtualenv/commit/5b91536…	x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.4	x_refsource_MISC

Vendor	Product	Version	CPE status
pypa	virtualenv	Affected: < 21.14.4	guessed

BREW-CHARM-TOOLS-CVE-202… (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 08:49 – Updated: 2026-10-22 08:49 – Source website

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-113726	ADVISORY
	https://github.com/pypa/virtualenv/commit/5b91536…	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://github.com/pypa/virtualenv/releases/tag/21.14.4	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@20.39.1",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "charm-tools",
        "purl": "pkg:brew/charm-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@20.39.1",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "20.39.1"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-charm-tools-CVE-2026-113726",
  "modified": "2026-10-22T08:49:42Z",
  "published": "2026-10-22T08:49:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}

BREW-HATCH-CVE-2026-113726 (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 09:30 – Updated: 2026-10-22 09:30 – Source website

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-113726	ADVISORY
	https://github.com/pypa/virtualenv/commit/5b91536…	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://github.com/pypa/virtualenv/releases/tag/21.14.4	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.6",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "hatch",
        "purl": "pkg:brew/hatch"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0"
            },
            {
              "fixed": "1.6.2"
            },
            {
              "introduced": "1.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.6",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.6"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-hatch-CVE-2026-113726",
  "modified": "2026-10-22T09:30:15Z",
  "published": "2026-10-22T09:30:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}

BREW-NOX-CVE-2026-113726 (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 10:41 – Updated: 2026-10-22 10:41 – Source website

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-113726	ADVISORY
	https://github.com/pypa/virtualenv/commit/5b91536…	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://github.com/pypa/virtualenv/releases/tag/21.14.4	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.11",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "nox",
        "purl": "pkg:brew/nox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2020.12.31"
            },
            {
              "fixed": "2022.8.7_1"
            },
            {
              "introduced": "2023.4.22_1"
            },
            {
              "fixed": "2026.10.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.11",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.11"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-nox-CVE-2026-113726",
  "modified": "2026-10-22T10:41:11Z",
  "published": "2026-10-22T10:41:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}

BREW-PIPENV-CVE-2026-113726 (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 09:47 – Updated: 2026-10-22 09:47 – Source website

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-113726	ADVISORY
	https://github.com/pypa/virtualenv/commit/5b91536…	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://github.com/pypa/virtualenv/releases/tag/21.14.4	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.11",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pipenv",
        "purl": "pkg:brew/pipenv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.3.0"
            },
            {
              "fixed": "2026.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.11",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.11"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-pipenv-CVE-2026-113726",
  "modified": "2026-10-22T09:47:00Z",
  "published": "2026-10-22T09:47:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}

BREW-PRE-COMMIT-CVE-2026… (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 09:38 – Updated: 2026-10-22 09:38 – Source website

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-113726	ADVISORY
	https://github.com/pypa/virtualenv/commit/5b91536…	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://github.com/pypa/virtualenv/releases/tag/21.14.4	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.7",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pre-commit",
        "purl": "pkg:brew/pre-commit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "0.14.1"
            },
            {
              "introduced": "2.3.0_1"
            },
            {
              "fixed": "2.20.0_1"
            },
            {
              "introduced": "3.6.1"
            },
            {
              "fixed": "4.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.7",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.7"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-pre-commit-CVE-2026-113726",
  "modified": "2026-10-22T09:38:37Z",
  "published": "2026-10-22T09:38:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}

BREW-TOX-CVE-2026-113726 (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 09:02 – Updated: 2026-10-22 09:02 – Source website

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-113726	ADVISORY
	https://github.com/pypa/virtualenv/commit/5b91536…	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://github.com/pypa/virtualenv/releases/tag/21.14.4	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.11",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "tox",
        "purl": "pkg:brew/tox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "4.64.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.11",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.11"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-tox-CVE-2026-113726",
  "modified": "2026-10-22T09:02:57Z",
  "published": "2026-10-22T09:02:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}

BREW-VIRTUALENVWRAPPER-C… (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 11:13 – Updated: 2026-10-22 11:13 – Source website

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-113726	ADVISORY
	https://github.com/pypa/virtualenv/commit/5b91536…	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://github.com/pypa/virtualenv/releases/tag/21.14.4	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.6",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "virtualenvwrapper",
        "purl": "pkg:brew/virtualenvwrapper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.8.4"
            },
            {
              "fixed": "4.8.4_2"
            },
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.1.1_3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.6",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.6"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-virtualenvwrapper-CVE-2026-113726",
  "modified": "2026-10-22T11:13:48Z",
  "published": "2026-10-22T11:13:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}

BREW-VIRTUALFISH-CVE-202… (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 09:00 – Updated: 2026-10-22 09:00 – Source website

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-113726	ADVISORY
	https://github.com/pypa/virtualenv/commit/5b91536…	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://github.com/pypa/virtualenv/releases/tag/21.14.4	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@21.14.6",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "virtualfish",
        "purl": "pkg:brew/virtualfish"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.5.5"
            },
            {
              "fixed": "2.5.9_4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@21.14.6",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "21.14.6"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-virtualfish-CVE-2026-113726",
  "modified": "2026-10-22T09:00:09Z",
  "published": "2026-10-22T09:00:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}

FKIE_CVE-2026-113726

Vulnerability from fkie_nvd - Published: 2026-10-20 22:19 - Updated: 2026-10-22 16:47

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value. The script assigns that value to PS1. In zsh with PROMPT_SUBST, an attacker-influenced environment directory, --prompt, or VIRTUALENV_PROMPT value containing command, parameter, or arithmetic expansion syntax can therefore execute commands in the user's shell each time the prompt is drawn. A percent sign is separately interpreted as a zsh prompt escape but does not by itself execute commands. Plain zsh with PROMPT_SUBST disabled and bash are not affected by this mechanism. This issue is fixed in version 21.14.4.

References

	URL	Tags
	security-advisories@github.com	https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2
	security-advisories@github.com	https://github.com/pypa/virtualenv/releases/tag/21.14.4
	security-advisories@github.com	https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "virtualenv",
          "vendor": "pypa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 21.14.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value. The script assigns that value to PS1. In zsh with PROMPT_SUBST, an attacker-influenced environment directory, --prompt, or VIRTUALENV_PROMPT value containing command, parameter, or arithmetic expansion syntax can therefore execute commands in the user\u0027s shell each time the prompt is drawn. A percent sign is separately interpreted as a zsh prompt escape but does not by itself execute commands. Plain zsh with PROMPT_SUBST disabled and bash are not affected by this mechanism. This issue is fixed in version 21.14.4."
    }
  ],
  "id": "CVE-2026-113726",
  "lastModified": "2026-10-22T16:47:38.403",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-20T22:19:29.423",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-5VJQ-RRRF-7H2Q

Vulnerability from github – Published: 2026-10-21 16:46 – Updated: 2026-10-21 16:46

Summary

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 21.14.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "virtualenv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "21.14.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-113726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-21T16:46:23Z",
    "nvd_published_at": "2026-10-20T22:19:29Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "GHSA-5vjq-rrrf-7h2q",
  "modified": "2026-10-21T16:46:23Z",
  "published": "2026-10-21T16:46:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST"
}

CVE-2026-113726 (GCVE-0-2026-113726)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

Action not permitted

CVE-2026-113726 (GCVE-0-2026-113726)

BREW-CHARM-TOOLS-CVE-202… (GHSA-5VJQ-RRRF-7H2Q)

Impact

Patches

Workarounds

Credits

BREW-HATCH-CVE-2026-113726 (GHSA-5VJQ-RRRF-7H2Q)

Impact

Patches

Workarounds

Credits

BREW-NOX-CVE-2026-113726 (GHSA-5VJQ-RRRF-7H2Q)

Impact

Patches

Workarounds

Credits

BREW-PIPENV-CVE-2026-113726 (GHSA-5VJQ-RRRF-7H2Q)

Impact

Patches

Workarounds

Credits

BREW-PRE-COMMIT-CVE-2026… (GHSA-5VJQ-RRRF-7H2Q)

Impact

Patches

Workarounds

Credits

BREW-TOX-CVE-2026-113726 (GHSA-5VJQ-RRRF-7H2Q)

Impact

Patches

Workarounds

Credits

BREW-VIRTUALENVWRAPPER-C… (GHSA-5VJQ-RRRF-7H2Q)

Impact

Patches

Workarounds

Credits

BREW-VIRTUALFISH-CVE-202… (GHSA-5VJQ-RRRF-7H2Q)

Impact

Patches

Workarounds

Credits

FKIE_CVE-2026-113726

GHSA-5VJQ-RRRF-7H2Q

Impact

Patches

Workarounds

Credits

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour