virtualenv: Bash prompt values can change meaning under older compatibility modes

影響: pip:virtualenv < 21.14.9 → 21.14.9

Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does not establish ex…

Read on GitHub Advisory Database

On 10/24/2026, 07:21 AM, GitHub Advisory Database published "virtualenv: Bash prompt values can change meaning under older compatibility modes" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-113723.