virtualenv EUVD-2026-106869

Exploitation requires ALL of: (1) the victim uses zsh as their interactive shell; (2) the zsh PROMPT_SUBST option is enabled (not zsh's default, but commonly set by frameworks such as oh-my-zsh or in custom .zshrc configs); (3) the attacker controls the virtual environment's directory name, the virtualenv --prompt argument, or the VIRTUALENV_PROMPT environment variable, and populates it with command, parameter, or arithmetic expansion syntax; and (4) the victim activates that environment, causing the prompt to be drawn. Limiting factors that reduce real-world risk: bash is NOT affected (it already received escaping via the BASH_VERSION guard), plain zsh with PROMPT_SUBST disabled is NOT affected, a bare percent sign only triggers prompt escapes rather than command execution, and the attack needs a local victim to activate an attacker-influenced environment (UI:R, AV:L).

CVSS 3.1 scores this 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting arbitrary command execution in the victim's shell (full C/I/A) but gated behind local access and required user interaction. The real-world risk is meaningfully lower than the 7.8 headline because exploitation is conditional: it only affects zsh users who have PROMPT_SUBST enabled (not zsh's default, though frameworks like oh-my-zsh and many custom configs set it), and the attacker must influence the environment directory name, the --prompt argument, or VIRTUALENV_PROMPT. bash and plain zsh without PROMPT_SUBST are explicitly unaffected. No EPSS score was provided in the input and the CVE is not listed in CISA KEV, so there is no signal of active or widespread exploitation; exploitation status is best characterized as no public exploit identified, although the vendor's fix commit ships test payloads (e.g. x${$(touch PWNED)}y) that demonstrate the mechanism. No SSVC decision data was supplied. Net: this is a legitimate code-execution flaw in a ubiquitous developer tool, but the local vector, user-interaction requirement, and non-default shell configuration make it a prioritize-for-patching rather than emergency-response issue, most relevant to supply-chain/shared-environment scenarios.

An attacker distributes a Python project, template, or pre-named virtual environment (or influences VIRTUALENV_PROMPT / the --prompt value) whose environment name embeds zsh expansion syntax such as x${$(touch PWNED)}y. When a victim running zsh with PROMPT_SUBST activates the environment, the unescaped name is assigned to PS1 and the expansion executes attacker commands each time the prompt is drawn. No public exploit is identified at time of analysis, though the vendor's regression tests demonstrate the payload; the local vector and required activation (UI:R) mean the victim must take action against an attacker-supplied artifact.