{"id":"ghsa-ghsa-5vjq-rrrf-7h2q","seq":32746,"kind":"advisory","title":"virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST","url":"https://github.com/advisories/GHSA-5vjq-rrrf-7h2q","permalink":"https://vulnpulse.app/items/ghsa-ghsa-5vjq-rrrf-7h2q","summary":"影響: pip:virtualenv <= 21.14.3 → 21.14.4\nImpact zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's she…","severity":"high","techs":["python"],"cves":["CVE-2026-113726"],"tags":["GHSA-5vjq-rrrf-7h2q","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T16:46:23.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}