CVE-2026-113726: virtualenv Command Injection Vulnerability in zsh with PROMPT_SUBST
Summary
CVE-2026-113726: virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST. Affects virtualenv versions < 21.14.4. Fixed in 21.14.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
virtualenv is a popular Python package that allows users to create isolated Python environments. This functionality is crucial for managing dependencies and avoiding conflicts between projects. However, a vulnerability has been identified that affects users of zsh when activating environments, particularly those using the PROMPT_SUBST option, which can lead to command injection.
Vulnerability Detail
The vulnerability arises when zsh users activate a virtualenv environment using the bash 'activate' script. The script places the environment name into the PS1 variable, which controls the shell prompt. If the environment name contains special characters like $(...), backticks, or ${...}, these can be executed as commands in the user's shell due to zsh's PROMPT_SUBST feature. This can lead to arbitrary code execution, allowing an attacker to run malicious commands. The issue affects versions up to and including 21.14.3, with the payload confirmed to execute in versions 20.26.6 and 21.14.3.
How To Fix
Latest published version: 21.14.12 as of 22 Oct 2026
pip install --upgrade "virtualenv==21.14.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.14.4
This is the first release that contains the fix.
pip install --upgrade "virtualenv==21.14.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the environment variable VIRTUAL_ENV_DISABLE_PROMPT=1 before sourcing the activate script. This will prevent the PS1 variable from being modified. You can do this by running the following command in your terminal: 'export VIRTUAL_ENV_DISABLE_PROMPT=1'. Alternatively, you can run 'unsetopt prompt_subst' if your prompt does not require it.
Conclusion
The vulnerability CVE-2026-113726 in virtualenv poses a significant risk to users of zsh who activate environments with specific naming conventions. It is crucial to update to the patched version 21.14.4 or apply the provided workarounds to mitigate the risk of command injection.
See every vulnerability recorded for virtualenv →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Versions of virtualenv up to and including 21.14.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update virtualenv right away, consider using the workaround by setting VIRTUAL_ENV_DISABLE_PROMPT=1 before activating your environment.
PROMPT_SUBST is a zsh option that allows parameter expansion, command substitution, and arithmetic expansion in the PS1 prompt variable, which can lead to command execution if not handled properly.
References
Related vulnerabilities
Recent vulnerabilities recorded for virtualenv.
