CVE-2026-115586

The virtualenv tool (versions 21.14.9 through 21.14.13 ) contains a regression where the bash bin/activate script fails to escape dollar signs or backticks in the --prompt value when promptvars and POSIX mode are disabled. This allows an attacker to inject command substitutions into the PS1 promp...