CVE-2026-115586 pypa CVE debrief

Who should care

Defenders responsible for virtualenv environments, particularly those using bash activators, should assess exposure and prioritize verification and remediation. This includes reviewing usage of virtualenv bash activators, monitoring for suspicious activity, and verifying and upgrading to version 21.14.13 or later. Security teams and vulnerability management teams should also be aware of the potential impact on their environments.

Why it matters

Defenders should care about CVE-2026-115586 because it allows for command execution in virtualenv environments, particularly those using bash activators. The vulnerability was introduced in version 21.14.9 and fixed in version 21.14.13. Defenders responsible for virtualenv environments should assess exposure, prioritize verification and remediation, and monitor for suspicious activity.

• Command execution as the user who sources bin/activate
• Potential for lateral movement in virtualenv environments
• Need for verification of virtualenv version and usage

Technical summary

The virtualenv bash activator puts the caller-supplied prompt value into PS1 unescaped when promptvars is off, allowing for command execution as the user who sources bin/activate. This occurs because promptvars and posix mode are runtime shell state, not properties of the activation moment. Re-enabling prompt expansion in the same shell or starting an interactive child bash that inherits the exported PS1 makes bash expand the stored value and run the command substitution in it. The issue was introduced in version 21.14.9 and fixed in version 21.14.13.

Defensive priority

Defenders should prioritize verifying and upgrading to version 21.14.13 or later, and review usage of virtualenv bash activators.

Recommended defensive actions

• Verify and upgrade to version 21.14.13 or later
• Review usage of virtualenv bash activators
• Monitor for suspicious activity in virtualenv environments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its introduction in version 21.14.9 and fix in version 21.14.13. The vulnerability allows for command execution as the user who sources bin/activate due to the improper handling of the --prompt value. Evidence of the vulnerability includes the CVE record, source item details, and technical analysis of the bash activator code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.