## virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-115586
- 公開日時: 2026-10-23T20:47:16.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-cx6f-vjhg-g3cc)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-cx6f-vjhg-g3cc

影響: pip:virtualenv >= 21.14.9, < 21.14.13 → 21.14.13
The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (shopt -s promptvars, set -o posix) or starting an interactive child bash that inherits the exported PS1 makes bash expand the stored value and run the command substitution in it. An…