virtualenv CVE-2026-113725

Requires: (1) an interactive bash shell - the flaw is in bash's two-pass PS1 handling and the ZSH activator path is explicitly unaffected; (2) the prompt-setting code active, i.e. VIRTUAL_ENV_DISABLE_PROMPT is NOT set; (3) an attacker-controlled environment name or --prompt value containing a backslash before command substitution '\$(...)' or backticks; and (4) the victim actually activating that environment (UI:R). Limiting factors: exploitation is local only (no network vector), does not affect zsh users, is nullified when the prompt is disabled, and depends on the attacker influencing the env name before the victim sources activate.sh - reducing realistic risk to developer/CI targeting rather than broad exploitation. Fixed in virtualenv 21.14.7.

Signals are consistent and point to a moderate, developer-centric risk rather than a mass-exploitation emergency. The CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R) correctly models this as a LOCAL vulnerability requiring user interaction: an attacker cannot reach it over the network - a victim must activate a virtualenv whose name (or --prompt value) is attacker-controlled, in an interactive bash shell with the prompt enabled. The CWE-78 command-injection impact is genuine and severe once triggered (C:H/I:H/A:H - arbitrary commands run in the user's shell context on every prompt redraw), which justifies the 7.8 base score. No EPSS score, KEV listing, or public weaponized exploit was provided in the input, so there is no evidence of active exploitation; this is a high-CVSS issue whose REAL-WORLD likelihood is throttled by the UI:R/AV:L prerequisites and the need for attacker influence over an environment name. The practical exposure is supply-chain / social-engineering style (e.g., a cloned repo, project template, or automation that creates a venv with a crafted name). Note the bug is bash-specific (the ZSH path is explicitly separate in the fix), so zsh users and non-interactive use are unaffected - AV:L plus bash-only plus activation dependency means targeted developer/CI compromise, not widespread opportunistic attack.

An attacker publishes a repository, project template, or setup script that creates or instructs the victim to create a virtualenv whose name or --prompt value embeds a backslash before a command substitution, e.g. 'x\$(touch PWNED)y'. When the developer activates that environment in bash, the double-pass PS1 handling undoes the escaping and the embedded command executes in their shell each time the prompt is drawn. The fix commit ships regression tests demonstrating the technique, but no standalone public exploit was reported in the input.