Live › vulnerability › CVE-2026-113726
Go to dashboardvirtualenv's bash activate script does not escape the environment name for zsh, so a name containing $(...), backticks or ${...} runs as shell commands each time the prompt is drawn when zsh PROMPT_SUBST is on. An attacker who can influence the environment path, --prompt or VIRTUALENV_PROMPT gets code execution in the victim's zsh session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| virtualenv | pypi | <= 21.14.3 | 21.14.4 |
Run echo $options[prompt_subst] or setopt | grep prompt_subst in zsh to see if PROMPT_SUBST is on (oh-my-zsh enables it by default).
Run pip show virtualenv and check whether the version is 21.14.3 or lower.
List environment directory names and check for $, backtick or % characters, e.g. ls -d */ | grep -E '[$%]'`.
Upgrade virtualenv to 21.14.4 or later.
Until then, set VIRTUAL_ENV_DISABLE_PROMPT=1 before sourcing activate, or run unsetopt prompt_subst in zsh.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since
21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so
zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and
arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then
runs as commands in the user's shell, once per prompt.
The name comes from the environment directory, or from --prompt or VIRTUALENV_PROMPT. After you create an
environment with:
$ virtualenv 'x$(touch PWNED)y'
source 'x$(touch PWNED)y/bin/activate' in a zsh session with PROMPT_SUBST set creates PWNED, and the prompt shows
(xy). Passing that value as --prompt to an environment with a plain name has the same effect. Without
PROMPT_SUBST, zsh shows the name as text and runs nothing. bash runs nothing either.
A plain zsh starts with PROMPT_SUBST off. oh-my-zsh users have it on: oh-my-zsh loads
lib/theme-and-appearance.zsh
at startup, and that file sets it. An attacker needs to influence the environment path or prompt: a CI job or wrapper
tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.
--prompt . takes the current directory's name.
zsh also reads % in PS1 as a prompt escape, so a name with %n showed the user name in place of those characters,
though without running commands.
The bug is in releases up to and including 21.14.3. The payload runs on 20.26.6 and 21.14.3, and the reporter confirmed 21.9.1.
Fixed in 21.14.4. Under zsh, activate now escapes the name the way it does under bash and doubles
%, so the example above runs nothing and the prompt shows the name as given. zsh gets the escaping even when
PROMPT_SUBST is off, because a user can set the option after activation; a name with a backslash, dollar sign or
backtick then shows the added backslashes.
Fix: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2
Set VIRTUAL_ENV_DISABLE_PROMPT=1 before you source activate, which leaves PS1 alone, or run
unsetopt prompt_subst if your prompt does not need it. Check the name of an environment you did not create before you
source its activate.
Kaya Emre Arikan (@kemrec) reported this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-113726")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.