virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

影響: pip:virtualenv >= 21.14.9, < 21.14.13 → 21.14.13

The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt expansion in the same shell (shopt -s promptvars, set -o posix) or starting an interactive child bash that inherits the exported PS1 makes bash expand the stored value and run the command substitution in it. An…

Read on GitHub Advisory Database

On 10/24/2026, 05:47 AM, GitHub Advisory Database published "virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-115586.