Threats tagged 'brew-hatch-cve-2026-115586'

A command injection vulnerability exists in the bash activation script of virtualenv when the shell option 'promptvars' is off at activation time. The bash activator inserts the user-supplied --prompt value into PS1 without escaping special characters, allowing subsequent re-enabling of prompt expansion to execute arbitrary commands embedded in the prompt. This regression was introduced in version 21.14.9 and persists in 21.14.12. The vulnerability allows an attacker controlling the prompt value to execute commands as the user who activates the virtual environment.