CVE-2026-115586: 
Python vulnerability analysis and mitigation

CVE-2026-115586 is an OS command injection vulnerability in the pypa/virtualenv Python tool, specifically in its bash bin/activate script. Introduced as a regression in version 21.14.9, the flaw allows an attacker-controlled --prompt value to be stored unescaped in the shell's PS1 variable, enabling command substitution execution when certain bash options are toggled after activation. Affected versions are >= 21.14.9 and < 21.14.13; the issue is fixed in version 21.14.13. It carries a CVSS v3.1 base score of 7.0 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The regression was introduced in commit 5f48d711 (part of the fix for GHSA-6w3r-xr62-4xcp), which rewrote the bash prompt-handling block in src/virtualenv/activation/bash/activate.sh and removed unconditional escaping of $ and backtick characters from the bash code path. When promptvars is disabled at activation time, the script copies the raw VIRTUAL_ENV_PROMPT value directly into PS1 without escaping special characters. Because promptvars and POSIX mode are runtime shell states rather than fixed properties of the activation moment, subsequently running shopt -s promptvars, set -o posix, or launching an interactive child bash that inherits the exported PS1 causes bash to expand any embedded command substitutions (e.g., $(id > /tmp/ve-pwn)) on the next prompt redraw. The --prompt value can originate from project metadata or tool configuration that the activating user did not author, making this a supply-chain-style attack vector. A public proof-of-concept is included in the GitHub security advisory (GitHub Advisory, Fix PR).

Successful exploitation results in arbitrary command execution with the full privileges of the user who sources bin/activate — there is no privilege escalation beyond the activating user's account. Confidentiality, integrity, and availability are all rated High, as an attacker can read sensitive files, modify data, or disrupt the user's environment. The malicious payload is also persisted in pyvenv.cfg and the generated activation script, meaning it survives the initial activation session and can fire in a different shell session on the first prompt redraw with expansion enabled (GitHub Advisory, Red Hat Bugzilla).

There is no evidence of in-the-wild exploitation or a standalone public exploit kit at this time; however, a detailed proof-of-concept is published within the GitHub security advisory itself (GitHub Advisory). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not automatable (requires user interaction — the victim must source the activation script) and has high attack complexity, as specific shell state conditions must be met post-activation. No threat actor attribution has been reported.

1. Craft a malicious prompt: An attacker prepares a virtualenv --prompt value containing a command substitution payload, e.g., x$(id > /tmp/ve-pwn)y.
2. Deliver the poisoned environment: The attacker supplies this prompt via a malicious project's metadata, a tool configuration file, or by directly invoking python -m virtualenv --no-seed --activators bash --prompt 'x$(id > /tmp/ve-pwn)y' /tmp/venv-demo on a system where they can influence the environment creation step.
3. Victim activates the environment: The victim runs source /tmp/venv-demo/bin/activate in a bash shell where promptvars is disabled (e.g., via shopt -u promptvars in their ~/.bashrc). The raw payload is stored in PS1 without escaping.
4. Trigger command execution: Execution occurs when any of the following happens in the same shell session: (a) shopt -s promptvars is run, (b) set -o posix is run, or (c) an interactive child bash is started that inherits the exported PS1. On the next prompt redraw, bash expands the command substitution and executes the embedded command as the victim user.
5. Payload executes: The injected command runs with the victim's privileges. In the PoC, uid=1000(user) ... is written to /tmp/ve-pwn; in a real attack, this could be a reverse shell, credential theft, or file exfiltration (GitHub Advisory).

• File System: Unexpected files created in /tmp/ or other writable directories (e.g., /tmp/ve-pwn) shortly after a user activates a virtual environment; presence of virtualenv bin/activate scripts containing unescaped $(...) or backtick sequences in the PS1 or VIRTUAL_ENV_PROMPT assignment.
• Logs: Shell history entries showing source bin/activate or . bin/activate followed by unexpected commands; audit logs recording file creation or network connections initiated by a bash process shortly after prompt redraw.
• Process: Unexpected child processes (e.g., curl, wget, bash, python, nc) spawned from an interactive bash session immediately after a virtual environment is activated or after shopt -s promptvars / set -o posix is executed.
• Configuration: pyvenv.cfg files or bin/activate scripts within virtual environments containing shell metacharacters ($, backtick) in the VIRTUAL_ENV_PROMPT variable assignment (GitHub Advisory).

Upgrade virtualenv to version 21.14.13 or later, which escapes $ and backtick characters in the bash prompt for all PS1 states (Release 21.14.13, Fix PR). For users unable to upgrade immediately, the following workarounds reduce risk:

• Set VIRTUAL_ENV_DISABLE_PROMPT=1 before sourcing bin/activate to skip the prompt block entirely.
• Avoid activating virtual environments created with untrusted or externally-supplied --prompt values.
• Do not use shopt -u promptvars in shell configurations when activating environments from untrusted sources.
• Restrict who can create virtual environments in shared or CI/CD environments and audit bin/activate scripts for unescaped shell metacharacters before activation (GitHub Advisory).

The vulnerability was reported by researcher rozzkml and fixed by virtualenv maintainer gaborbernat on October 22, 2026, with the patch merged in PR #3466 (Fix PR). The advisory notes this is a regression from the fix for a prior related issue (GHSA-6w3r-xr62-4xcp), highlighting the difficulty of correctly handling shell prompt escaping across multiple bash states. The fix was quickly picked up by downstream projects, with dependency bump PRs appearing within a day of disclosure (GitHub Advisory). Red Hat tracked the issue via Bugzilla with a medium severity rating (Red Hat Bugzilla).