CVE-2026-113723 is a vulnerability in virtualenv's bash activation prompt handling where attacker-controlled prompt text can be interpreted as executable shell syntax under certain older bash compatibility modes (4.2 and below) or when using dash shell. This occurs because the prompt string assigned to PS1 is expanded twice, allowing command execution when the prompt is drawn. The issue affects POSIX activation scripts and arises if an attacker can supply the prompt value and a user activates the environment in an affected shell configuration.