PyPI/virtualenv CVE-2026-115586: high
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
Action: Upgrade virtualenv to 21.14.13 or later.
pip install virtualenv==21.14.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 21.14.9 | 21.14.13 | - |
Fixed versions
| 21.14.13 |
Sources
- osv: GHSA-cx6f-vjhg-g3cc
- https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc
- https://github.com/pypa/virtualenv/pull/3466
- https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4
- https://github.com/pypa/virtualenv
- https://github.com/pypa/virtualenv/releases/tag/21.14.13
CVE-2026-115586 · published · modified · JSON