PyPA virtualenv: Command injection via environment name in zsh prompt
Summary
virtualenv versions 21.13.0 up to 21.14.4 (and earlier versions for the bash activation script) do not properly escape the environment name, --prompt value or VIRTUALENV_PROMPT value when the activate script is used in zsh with PROMPT_SUBST enabled. An attacker who can influence the directory name or prompt setting can make the shell execute commands each time the prompt is drawn, with the user's privileges. Exploitation requires a user to activate an attacker-influenced environment, so it is mainly a risk for developer workstations and CI systems.
Affected
- virtualenv before 21.14.4 (per CNA record; mechanism present from 21.13.0 onwards for zsh)
- Only zsh with PROMPT_SUBST enabled (for example common oh-my-zsh setups)
- Plain zsh with PROMPT_SUBST disabled and bash are not affected by this mechanism
Fixed in
- Fixed in virtualenv 21.14.4 (fix commit 5b915367da82bd024b2a0d28d2f98007034b4aa2)
- A separate, related issue (GHSA-cx6f-vjhg-g3cc, not this CVE) affects the bash activator; move to the latest virtualenv release, not just 21.14.4
Workaround
- Set VIRTUAL_ENV_DISABLE_PROMPT=1 before sourcing the activate script, which leaves PS1 unchanged
- Or run 'unsetopt prompt_subst' in zsh if the prompt does not need it
- Not needed where 21.14.4 or later is installed
Exploitation
- Public details: the advisory describes the mechanism and includes a demonstration command
- Exploited in the wild: none found in the sources checked; CISA KEV not verified
- CISA SSVC: exploitation none, automatable no, technical impact total
- EPSS approx. 0.0023 to 0.0026
Our recommendation
- Update virtualenv on developer machines and CI images to the latest release
- Check repositories and build images for pinned or vendored virtualenv copies and update them
- Avoid activating environments from untrusted repositories or templates in zsh with PROMPT_SUBST enabled
- Monitor dependency scanner findings for virtualenv
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5vjq-rrrf-7h2q github.com
- Release 21.14.4 github.com
- Fix commit 5b91536 github.com
- OSV GHSA-5vjq-rrrf-7h2q osv.dev
- Vulners CNA record CVELIST:CVE-2026-113726 vulners.com
- virtualenv changelog 21.14.4 virtualenv.pypa.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:24.
Original description (NVD)
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value. The script assigns that value to PS1. In zsh with PROMPT_SUBST, an attacker-influenced environment directory, --prompt, or VIRTUALENV_PROMPT value containing command, parameter, or arithmetic expansion syntax can therefore execute commands in the user's shell each time the prompt is drawn. A percent sign is separately interpreted as a zsh prompt escape but does not by itself execute commands. Plain zsh with PROMPT_SUBST disabled and bash are not affected by this mechanism. This issue is fixed in version 21.14.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.