BREW-CHARM-TOOLS-CVE-202… (GHSA-5VJQ-RRRF-7H2Q)

Vulnerability from osv_homebrew – Published: 2026-10-22 08:49 – Updated: 2026-10-22 08:49 – Source website
VLAI
Summary
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
Details

Impact

zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's shell, once per prompt.

The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an environment with:

$ virtualenv 'x$(touch PWNED)y'

source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows (xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.

A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads lib/theme-and-appearance.zsh at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive. --prompt . takes the current directory's name.

zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters, though without running commands.

The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.

Patches

Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles %, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or backtick then shows the added backslashes. Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2

Workarounds

Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you source its activate.

Credits

Kaya Emre Arikan (@kemrec) reported this issue.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@20.39.1",
        "upstream_fixed_in": "21.14.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "charm-tools",
        "purl": "pkg:brew/charm-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@20.39.1",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "20.39.1"
      }
    ]
  },
  "details": "### Impact\n\nzsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since\n21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so\nzsh gets the raw value. With the `PROMPT_SUBST` option set, zsh runs parameter expansion, command substitution and\narithmetic expansion on `PS1` each time it draws the prompt. A name that contains `$(...)`, backticks or `${...}` then\nruns as commands in the user\u0027s shell, once per prompt.\n\nThe name comes from the environment directory, or from `--prompt` or `VIRTUALENV_PROMPT`. After you create an\nenvironment with:\n\n```console\n$ virtualenv \u0027x$(touch PWNED)y\u0027\n```\n\n`source \u0027x$(touch PWNED)y/bin/activate\u0027` in a zsh session with `PROMPT_SUBST` set creates `PWNED`, and the prompt shows\n`(xy)`. Passing that value as `--prompt` to an environment with a plain name has the same effect. Without\n`PROMPT_SUBST`, zsh shows the name as text and runs nothing. bash runs nothing either.\n\nA plain zsh starts with `PROMPT_SUBST` off. oh-my-zsh users have it on: oh-my-zsh loads\n[`lib/theme-and-appearance.zsh`](https://github.com/ohmyzsh/ohmyzsh/blob/4d4cfc287e9d887b81242c0e431b5f49f9cec5c1/lib/theme-and-appearance.zsh#L5)\nat startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper\ntool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n`--prompt .` takes the current directory\u0027s name.\n\nzsh also reads `%` in `PS1` as a prompt escape, so a name with `%n` showed the user name in place of those characters,\nthough without running commands.\n\nThe bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed\n21.9.1.\n\n### Patches\n\nFixed in 21.14.4. Under zsh, `activate` now escapes the name the way it does under bash and doubles\n`%`, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when\n`PROMPT_SUBST` is off, because a user can set the option after activation; a name with a backslash, dollar sign or\nbacktick then shows the added backslashes.\nFix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2\n\n### Workarounds\n\nSet `VIRTUAL_ENV_DISABLE_PROMPT=1` before you source `activate`, which leaves `PS1` alone, or run\n`unsetopt prompt_subst` if your prompt does not need it. Check the name of an environment you did not create before you\nsource its `activate`.\n\n### Credits\n\nKaya Emre Arikan (@kemrec) reported this issue.",
  "id": "BREW-charm-tools-CVE-2026-113726",
  "modified": "2026-10-22T08:49:42Z",
  "published": "2026-10-22T08:49:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",
  "upstream": [
    "GHSA-5vjq-rrrf-7h2q",
    "CVE-2026-113726"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.