cyfenced.com →

[ CVE-2026-113725 · Published 20 Oct 2026 ]

virtualenv bash activate runs commands from an environment name with a backslash before $

CVSS 7.8 EPSS <1%Fix available

[ Description ]Official description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7.

[ Fixes ]Fixes and patches

  • virtualenv 21.14.7Fixed version · GitHub Advisories · pip package virtualenv: upgrade to 21.14.7 or later (affected <= 21.14.6)

[ Packages ]Affected open-source packages

[ References ]References