## virtualenv: Bash prompt values can change meaning under older compatibility modes

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-113723
- 公開日時: 2026-10-23T22:21:57.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-6w3r-xr62-4xcp)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-6w3r-xr62-4xcp

影響: pip:virtualenv < 21.14.9 → 21.14.9
Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does not establish ex…