{"action":"Upgrade virtualenv to 21.14.13 or later.","affected":[{"fixed":"21.14.13","introduced":"21.14.9"}],"component":"virtualenv","cve_ids":["CVE-2026-115586"],"ecosystem":"PyPI","epss":0.00189,"exploited":false,"fixed_versions":["21.14.13"],"ghsa_id":"GHSA-cx6f-vjhg-g3cc","id":"tcs_01M5NAT0VP72EYREK4ASSD22QC","modified_at":"2026-10-23T21:00:06.246911841Z","published_at":"2026-10-23T20:47:16Z","references":["https://osv.dev/vulnerability/GHSA-cx6f-vjhg-g3cc","https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc","https://github.com/pypa/virtualenv/pull/3466","https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4","https://github.com/pypa/virtualenv","https://github.com/pypa/virtualenv/releases/tag/21.14.13"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-cx6f-vjhg-g3cc","url":"https://osv.dev/vulnerability/GHSA-cx6f-vjhg-g3cc"}],"summary":"virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)"}