OS Command Injection in py3-virtualenv - CVE-2026-115586
Published: November 9, 2026
Vulnerability identifier: #VU163152
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-115586
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker controlling the environment prompt to execute arbitrary commands as the user who activates a virtual environment.
The vulnerability exists due to missing escaping in virtualenv's Bash activator when promptvars and POSIX mode are disabled during activation. An attacker controlling the environment prompt can supply command substitutions through --prompt that execute when the victim subsequently enables prompt expansion and Bash redraws the prompt.
Affected software
py3-virtualenv
How to mitigate CVE-2026-115586
Install security update from vendor's website.
py3-virtualenv - update to 21.14.13