CVE-2026-113725: virtualenv bash activate runs commands from an environment name with a backslash before $

October 21, 2026

The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user’s shell each time bash draws the prompt.

References

github.com/advisories/GHSA-vxj4-q4g9-crj7
github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932
github.com/pypa/virtualenv/releases/tag/21.14.7
github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7
nvd.nist.gov/vuln/detail/CVE-2026-113725

Code Behaviors & Features

Detect and mitigate CVE-2026-113725 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →