{"id":"ghsa-ghsa-6w3r-xr62-4xcp","seq":661285,"kind":"advisory","title":"virtualenv: Bash prompt values can change meaning under older compatibility modes","url":"https://github.com/advisories/GHSA-6w3r-xr62-4xcp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6w3r-xr62-4xcp","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nCaller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does not establish ex…","severity":"high","techs":["python"],"cves":["CVE-2026-113723"],"tags":["GHSA-6w3r-xr62-4xcp","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:21:57.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}