CVE-2026-115586 in virtualenv
Summary
by MITRE • 10/23/2026
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within virtualenv versions ranging from 21.14.9 to 21.14.13 represents a critical command injection flaw rooted in improper input sanitization during the environment activation process. Virtualenv is widely utilized by developers and operations teams to create isolated Python environments, ensuring dependency isolation across different projects. The core of this vulnerability lies in the bash shell script responsible for activating these virtual environments, specifically regarding how it handles user-supplied prompt configurations. When a developer or automated system creates a new environment with a custom prompt string via the --prompt argument, that value is intended to be displayed in the terminal interface to indicate which environment is currently active. However, within this specific version range, the activation script fails to properly escape special shell metacharacters when writing this prompt into the PS1 variable under certain configuration conditions.
The technical mechanism of exploitation relies on a combination of bash shell features and environmental state configurations. Specifically, if both the promptvars option and POSIX mode are disabled during the execution of the activate script, the tool copies the attacker-controlled --prompt value directly into the PS1 environment variable without escaping dollar signs or backticks. In standard Bash operation, these characters denote command substitution, allowing for the evaluation of embedded commands within strings. While immediate exploitation is not possible if promptvars remains enabled and POSIX mode stays off, as bash would treat the content literally in that specific context, the vulnerability manifests when the shell state changes subsequently. If a user or script re-enables promptvars, switches to POSIX-compliant mode using set -o posix, or spawns an interactive child bash process that inherits the exported PS1 variable, the stored VIRTUAL_ENV_PROMPT value undergoes expansion. This results in the execution of any commands embedded within the maliciously crafted prompt string with the privileges of the user who activated the environment.
This flaw is particularly dangerous because it can be triggered indirectly through social engineering or compromised build pipelines where an attacker controls the parameters passed to virtualenv during project setup. For instance, if a developer clones a repository containing a configuration file that instructs tools like tox or nox to create environments with malicious prompt strings, simply running those tooling commands could lead to arbitrary code execution upon activation of the environment in subsequent sessions. The impact is severe as it allows for remote command injection without requiring direct shell access at the moment of creation, relying instead on standard development workflows that involve activating virtual environments regularly. This aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and reflects techniques associated with ATT&CK tactic T1059 Command and Scripting Interpreter, specifically sub-techniques involving bash or sh scripts.
Mitigation for this vulnerability is straightforward and primarily involves upgrading the virtualenv package to version 21.14.13 or later, where the issue has been resolved by ensuring proper escaping of special characters regardless of shell configuration states. For organizations unable to upgrade immediately due to dependency constraints, alternative mitigation strategies include avoiding the use of custom prompt values derived from untrusted sources and being cautious when activating virtual environments created in potentially compromised repositories. Additionally, maintaining strict control over environment variables such as PS1 within CI/CD pipelines can reduce the attack surface. Security teams should audit their automation scripts for any usage of --prompt flags with dynamic inputs to ensure that no malicious payloads are inadvertently introduced into developer workstations or production build agents through this vector.