VDB
CVE-2026-115586
CVE-2026-115586
PUBLISHED
CVSS 7.1 HIGH
Reported by GitHub_M · Published October 23, 2026
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.
Risk Scores
CVSS 4.0
7.1
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pypa | virtualenv | >= 21.14.9, < 21.14.13 |
| chainguard | openstack-rally-2025.2 | 0 |
| chainguard | openstack-rally-2026.1 | 0 |
| chainguard | request-1276 | 0 |
| PyPI | virtualenv | 21.14.9 |
| pypa | virtualenv | 21.14.9 |
Timeline
- Oct 23, 2026 CVE Published
- Oct 23, 2026 Coalition ESS Score
- Oct 23, 2026 CVE Updated
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 EPSS Score
- Oct 31, 2026 Security Advisory
References
- https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc x_refsource_CONFIRM
- https://github.com/pypa/virtualenv/pull/3466 x_refsource_MISC
- https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4 x_refsource_MISC
- https://github.com/pypa/virtualenv/releases/tag/21.14.13 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-115586 advisory
- https://github.com/advisories/GHSA-cx6f-vjhg-g3cc advisory