CVE-2026-113723

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

Summary

Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.

Affected area

Bash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from newer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation. It does not establish exposure through unrelated activators.

Attacker-controlled input

The attacker controls prompt or destination data passed as a virtualenv argument. The user later sources the generated activation script.

Affected code

The relevant 21.14.8 source is in bash prompt assembly.

Mechanism

bin/activate copies the prompt into PS1. A shell expands PS1 again when it draws a prompt, so the value must survive both the assignment and that later expansion. The bash and zsh branches escape for their usual prompt rules. Three other paths still interpret prompt data as commands: dash sourcing activate directly, a child dash inheriting an exported PS1 from bash, and bash running at compatibility level 4.2 or lower. A value such as x$(touch MARKER)y then runs touch on prompt display. Creating the environment does not run the payload.

Reproduction and evidence

The scanner's child-shell reproducer creates an environment with --prompt 'x$(touch MARKER)y', sources bin/activate in interactive bash, and starts interactive sh (dash). Its control leaves PS1 unexported: neither shell creates MARKER. With PS1 exported, bash displays the prompt without executing the value, but the child dash creates MARKER; the reproducer ends in BUG. The report gives separate console reproductions for direct dash activation and bash compatibility level 4.2. The child-shell path can arise after another environment's activation has exported PS1.

The scanner linked this finding to #3326 and its follow-up #3390. Those changes cover the usual bash path but leave the three paths above. The proposed change in #3418 keeps a variable reference in PS1, so prompt text is expanded as data when drawn. The private report's reproducer was run by the scanner; the later command-execution result was supplied by the maintainer review. This advisory does not claim that every POSIX shell or every bash mode is affected.

Introduced

The report traces direct dash sourcing to the first 20.x activator (20.0.0b1), and inherited PS1 to #3390 (first released in 21.14.7). It demonstrates the compatibility-level case on bash 5.2. Those historical boundaries come from the report; the release confirmed by the maintainer is 21.14.8.

Attack sequence

sequenceDiagram
    participant A as Prompt supplier
    participant V as virtualenv
    participant B as Interactive bash
    participant D as Child dash
    A->>V: --prompt x$(touch MARKER)y
    V->>B: generated bin/activate
    B->>B: assign escaped prompt to PS1
    alt PS1 is not exported
        B->>D: start sh with its own PS1
        D-->>B: marker absent
    else PS1 is exported
        B->>D: start sh with inherited PS1
        D->>D: expand $(touch MARKER) on prompt draw
        D-->>B: marker created
    end

Reproducer files

The following files are from the scanner report for ANT-2026-1MOI2X3T. They were tested against commit a857a7823c73 in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files are included as evidence and were not rerun for this advisory…

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.