{"id":"ghsa-ghsa-vxj4-q4g9-crj7","seq":32741,"kind":"advisory","title":"virtualenv bash activate runs commands from an environment name with a backslash before $","url":"https://github.com/advisories/GHSA-vxj4-q4g9-crj7","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vxj4-q4g9-crj7","summary":"影響: pip:virtualenv <= 21.14.6 → 21.14.7\nSummary The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \\$(...) runs as commands in the user's shell each time bash draws the prompt. Affected area src/virtualenv/activation/bash/activate.sh, the block that prepends the environment name to PS1. Attacker-controlled input The environment name: the environment directory's name, or the --prompt or VIRTUALENV_PROMPT value. A…","severity":"high","techs":["python"],"cves":["CVE-2026-113725"],"tags":["GHSA-vxj4-q4g9-crj7","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T16:49:01.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}