CVE-2026-113723 is a vulnerability in virtualenv's bash activation prompt handling where attacker-controlled prompt text can be interpreted as executable shell syntax under certain older bash compatibility modes (4.2 and lower) or when using dash shell. This can lead to command execution when the environment is activated and the prompt is drawn. The issue arises because the prompt string assigned to PS1 is expanded twice by the shell, and some code paths do not properly escape or sanitize the prompt text. The vulnerability affects virtualenv versions from 1.2.0 up to but not including 1.6.2 and 1.9.3 up to but not including 1.18.1_2. A fix is available in versions 1.6.2 and 1.18.1_2.