PyPA virtualenv: Zsh command injection in activate script (CVE-2026-113726)

The virtualenv activate script fails to properly sanitize the environment name when setting the PS1 prompt variable for zsh. In environments where the PROMPT_SUBST option is enabled (a default in frameworks like oh-my-zsh), the shell performs parameter and command substitution on the prompt string. An attacker who can influence the environment name or prompt string - such as through directory naming or CI/CD job metadata - can inject shell metacharacters (e.g., $(...), backticks) to execute arbitrary commands every time the prompt is rendered. This vulnerability affects virtualenv versions through 21.14.3.

Impact

Successful exploitation allows arbitrary command execution with the privileges of the user running the zsh session. This can be triggered by sourcing a malicious virtualenv activation script, which may be delivered via cloned repositories, unpacked archives, or CI/CD pipelines that dynamically name virtual environments based on external inputs.

Recommendation

• Update virtualenv to version 21.14.4 or later.
• For environments where immediate patching is not possible, set the environment variable VIRTUAL_ENV_DISABLE_PROMPT=1 before sourcing any activate script.
• Disable PROMPT_SUBST in zsh configurations if not strictly required for shell functionality.
• Audit existing virtual environment directories for suspicious characters in their naming convention, particularly those sourced within automated build environments or CI/CD runners.