CVE-2026-115586 virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115586?
CVE-2026-115586 is a high-severity vulnerability in pypa virtualenv, published on 23 Oct 2026.
Official description
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.
Weakness: CWE-78
Which versions are affected by CVE-2026-115586?
3 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | From 21.14.9 | 21.14.13 |
virtualenv PyPI | From 21.14.9 | 21.14.13 |
virtualenv PyPI | From 21.14.9 | 21.14.13 |
How do I fix CVE-2026-115586?
Upgrade virtualenv to 21.14.13 or later.
Is CVE-2026-115586 being exploited?
There is no known exploitation of CVE-2026-115586 in the wild and no public exploit code.
Sources
Also known as BIT-virtualenv-2026-115586, ECHO-838c-3d75-21e8, GHSA-cx6f-vjhg-g3cc, UBUNTU-CVE-2026-115586.