BIT-VIRTUALENV-2026-113726 virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

SUSE CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

Virtualenv Activate Runs Commands From The Environment Name In Zsh With PROMPT_SUBST

Impact zsh users activate an environment with the bash "activate" script, which puts the environment name into "PS1". Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when "BASHVERSION" is set, so zsh gets the raw value. With the "PROMPTSUBST" option...

EUVD-2026-106869

virtualenv activate runs commands from the environment name in zsh with PROMPTSUBST...

GHSA-5VJQ-RRRF-7H2Q virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Impact zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASHVERSION is set, so zsh gets the raw value. With the PROMPTSUBST option set, zs...

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Impact zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASHVERSION is set, so zsh gets the raw value. With the PROMPTSUBST option set, zs...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the activate.sh bash activation script, which zsh also sources, when a virtualenv is created with a name containing shell metacharacters such as $.... Because zsh with PROMPTSUBST re-expands PS1 on every prompt dra...

DEBIAN-CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

AZL-110100 CVE-2026-113726 affecting package python-virtualenv for versions less than 20.36.1-10

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

AZL-110076 CVE-2026-113726 affecting package python-pip 24.2-10

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726 virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

The virtualenv tool is vulnerable to command injection when using the bash activate script in zsh with PROMPT_SUBST enabled. Prior to version 21.13.0, the environment name was left unescaped; from 21.13.0 until 21.14.4, it only escaped specific characters when BASH_VERSION was set, allowing zsh t...

CVE-2026-113726 virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113726 virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.4. This vulnerability stems from improper escaping of environment names in the bash activate script. When PROMPTSUBST is enabled in zsh, values such as environment directories, --prompt, or...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: zsh (UTSA-2026-061494)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-061494 advisory. In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because...

CentOS 9 : zsh-5.8-9.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the zsh-5.8-9.el9 build changelog. - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This...