CVE-2026-115586: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in pypa virtualenv

The vulnerability in pypa virtualenv affects versions from 21.14.9 up to but not including 21.14.13. When both promptvars and POSIX mode are disabled during activation, the bash bin/activate script copies the --prompt value into PS1 without escaping dollar signs or backticks. If an attacker controls the --prompt value, they can inject commands that get executed when the prompt is expanded, such as by re-enabling promptvars, setting POSIX mode, or starting an interactive child bash that inherits the PS1 variable. This constitutes an OS command injection (CWE-78). The issue is resolved in version 21.14.13.

An attacker who can supply a malicious --prompt value can achieve command execution as the user activating the virtual environment. This could lead to unauthorized command execution within the context of the user's shell session. The vulnerability requires user interaction (activating the environment) and certain shell configurations to be exploitable.

Upgrade virtualenv to version 21.14.13 or later, where this vulnerability is fixed. Until then, avoid using untrusted input for the --prompt option or ensure that promptvars and POSIX mode are enabled during activation to prevent command substitution. No other vendor advisory content is provided; patch status is confirmed fixed in 21.14.13.