virtualenv EUVD-2026-105271

Exploitation requires three concrete conditions: (1) the attacker must control or influence the prompt string passed into virtualenv (e.g. the --prompt value or a name that feeds it); (2) the victim must activate the generated environment using the bash POSIX activation script and cause the prompt to be drawn; and (3) the victim's bash must be in a state that re-expands PS1 after decoding prompt escapes - specifically promptvars enabled (shopt promptvars), POSIX mode (set -o posix), or an older BASH_COMPAT compatibility level. Limiting factors: it is local-only (AV:L), not triggered in zsh or POSIX shells like dash (which the activator escapes or skips), requires active user interaction (UI:A), and does not fire under default bash configurations where PS1 is not re-expanded, which is why complexity is High with an attack requirement.

The input supplies a CVSS 4.0 vector (CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H, base 7.1) but no EPSS score, no CISA KEV listing, and no explicit POC flag, so there is no public exploit identified at time of analysis. The signals point consistently to a hard-to-weaponize, high-impact flaw rather than a mass-exploitation priority: AV:L means it is not remotely reachable, AC:H plus AT:P indicate the attacker needs a specific precondition (the victim's bash must expand PS1 - i.e. promptvars enabled, POSIX mode, or an older BASH_COMPAT level), and UI:A means a user must actively activate the environment and draw the prompt. PR:N is accurate in the sense that the attacker needs no privileges on the target, but exploitation hinges entirely on the attacker first influencing the prompt value that is baked into the activation script. The VC/VI/VA:H triad (effectively arbitrary command execution in the victim's shell) is what keeps this a genuine 7.1 rather than a cosmetic bug, but the combination of local vector, high complexity, required user interaction, and shell-configuration dependency means real-world risk is targeted and conditional, not broad. This is a credible developer/CI-pipeline supply-chain-style concern, not an internet-facing emergency.

An attacker influences the prompt text passed to virtualenv (for example, tooling or a shared project that derives the --prompt value from an attacker-controllable name) and embeds shell substitution such as $(malicious command). When a developer later activates that environment in bash and the prompt is drawn under a configuration that re-expands PS1 (promptvars on, POSIX mode, or older compatibility levels), the injected syntax executes as the developer. No public exploit is identified, though the vendor's own fix tests demonstrate the injection using a $(touch PWNED) prompt payload.