CVE-2026-115586High· 7.1▾ Twilightvirtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when bot…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.
virtualenv >= 21.14.9, < 21.14.13Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
virtualenv >= 21.14.9, < 21.14.13Patched in:
virtualenv 21.14.13Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113776High· 7.8virtualenv activation scripts run code from a path that contains a placeholder name
CVE-2026-113732High· 7.8virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
CVE-2026-113726High· 7.8virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
CVE-2026-113722High· 7.8virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
CVE-2026-113725High· 7.8virtualenv bash activate runs commands from an environment name with a backslash before $
CVE-2026-102937High· 7.3virtualenv is a tool for creating isolated virtual python environments