SB20261109211 - OS Command Injection in py3-virtualenv

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109211

SB20261109211 - OS Command Injection in py3-virtualenv

Published: November 9, 2026

Security Bulletin ID SB20261109211
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) OS Command Injection (CVE-ID: CVE-2026-115586)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an attacker controlling the environment prompt to execute arbitrary commands as the user who activates a virtual environment.

The vulnerability exists due to missing escaping in virtualenv's Bash activator when promptvars and POSIX mode are disabled during activation. An attacker controlling the environment prompt can supply command substitutions through --prompt that execute when the victim subsequently enables prompt expansion and Bash redraws the prompt.


Remediation

Install update from vendor's website.

References