{"id":"ghsa-ghsa-cx6f-vjhg-g3cc","seq":661338,"kind":"advisory","title":"virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)","url":"https://github.com/advisories/GHSA-cx6f-vjhg-g3cc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cx6f-vjhg-g3cc","summary":"影響: pip:virtualenv >= 21.14.9, < 21.14.13 → 21.14.13\nThe bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (shopt -s promptvars, set -o posix) or starting an interactive child bash that inherits the exported PS1 makes bash expand the stored value and run the command substitution in it. An…","severity":"high","techs":["python"],"cves":["CVE-2026-115586"],"tags":["GHSA-cx6f-vjhg-g3cc","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:47:16.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}