Patch virtualenv to stop arbitrary command execution in bash prompts

Security teams must update virtualenv installations to version 21.14.7 to mitigate a high-severity arbitrary command execution flaw. The vulnerability, tracked as CVE-2026-113725, affects the bash activation script used by Python virtual environments. Attackers can exploit this issue if they can influence the name of the virtual environment, allowing them to execute arbitrary commands in a user's shell every time the prompt is drawn.

The risk

The flaw resides in how the bash `activate` script handles the `PS1` environment variable. Bash processes this variable in two distinct passes. The first pass decodes backslash escapes, while the second handles command substitution. The virtualenv script prior to version 21.14.7 escapes special characters only for the second pass. This oversight means that if an environment name contains a backslash, it can undo the escaping during the first pass. Consequently, a name containing `$(...)` syntax will be interpreted and executed as a shell command by the user's terminal.

Who is exposed

Any user running bash and sourcing an `activate` script from a vulnerable virtualenv version is at risk. The attack vector requires an attacker to influence the environment name. This could occur through continuous integration jobs that pass branch or project names, wrapper tools, or by tricking a user into activating an environment from a cloned repository or unpacked archive with a malicious directory name. The `--prompt` flag or the `VIRTUALENV_PROMPT` variable can also serve as input vectors. Zsh users are not affected because zsh does not perform the initial decode pass on `PS1`.

Cost and compliance

The source material does not provide specific financial costs, regulatory implications, or compliance frameworks associated with this vulnerability. No data regarding affected organizations, breach counts, or industry-wide impact metrics is available in the advisory. The advisory focuses solely on the technical mechanics, affected versions, and mitigation steps for the software flaw itself.

Our take on the response

The vendor has provided a clear patch in version 21.14.7, which resolves the escaping logic error. Teams should prioritize updating their development environments and CI/CD pipelines immediately. Since the exploit requires user interaction (sourcing the script), the risk is lower than unauthenticated remote code execution, but the impact is high because it runs with the user's privileges. Ensuring all Python tooling is updated is a straightforward containment step.

What defenders should look for

Teams usually monitor for unexpected command executions originating from shell initialization scripts. Check whether terminal sessions are spawning processes that do not match standard user activity patterns. Look for anomalies in the `PS1` variable configuration or sudden changes in environment names within virtual environments. Investigate any file creation or network connections that occur immediately after a user activates a Python virtual environment. Containment moves typically involve isolating affected terminals and disabling prompt generation until the software is patched.

What to do and how to stay safe: virtualenv

• Update all virtualenv installations to version 21.14.7 or later to apply the official patch.
• Set the `VIRTUAL_ENV_DISABLE_PROMPT=1` environment variable before sourcing activate scripts if immediate patching is not possible.
• Audit CI/CD pipelines and wrapper tools to ensure they do not pass untrusted branch or project names into virtual environment prompts.
• Review recently cloned repositories or unpacked archives for directories with suspicious names containing backslashes or command substitution syntax.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of virtualenv are vulnerable to CVE-2026-113725?

All versions up to and including 21.14.6 are vulnerable. Version 21.14.7 contains the fix.

Is zsh affected by this vulnerability?

No, zsh is not affected because it does not perform the initial decode pass on the PS1 variable that bash uses.

How does an attacker trigger the exploit?

An attacker must influence the virtual environment's name, such as through a CI job or a malicious directory name, causing the bash shell to execute commands when the prompt is drawn.