CVE-2026-113726

The virtualenv tool is vulnerable to command injection when using the bash activate script in zsh with PROMPT_SUBST enabled. Prior to version 21.13.0, the environment name was left unescaped; from 21.13.0 until 21.14.4, it only escaped specific characters when BASH_VERSION was set, allowing zsh t...