Summary
A command injection vulnerability in virtualenv's shell activation script can cause attacker-influenced prompt values to be evaluated as shell syntax in zsh.
When zsh uses PROMPT_SUBST, a crafted environment directory, prompt option, or VIRTUALENV_PROMPT value may execute commands whenever the user's prompt is rendered.
A command injection vulnerability in virtualenv's shell activation script can cause attacker-influenced prompt values to be evaluated as shell syntax in zsh.
When zsh uses PROMPT_SUBST, a crafted environment directory, prompt option, or VIRTUALENV_PROMPT value may execute commands whenever the user's prompt is rendered.
Affected context
The issue occurs in virtualenv activation scripts used by zsh when prompt substitution is enabled. It requires an attacker-influenced environment name or prompt value containing command, parameter, or arithmetic expansion syntax. Bash and zsh sessions with PROMPT_SUBST disabled are not affected by this specific mechanism, and percent signs alone do not execute commands.
The issue occurs in virtualenv activation scripts used by zsh when prompt substitution is enabled. It requires an attacker-influenced environment name or prompt value containing command, parameter, or arithmetic expansion syntax. Bash and zsh sessions with PROMPT_SUBST disabled are not affected by this specific mechanism, and percent signs alone do not execute commands.
Exploit preconditions
- Attack surface: The generated shell activation script and the prompt value assigned to
PS1 - Required access: Ability to influence the virtual environment directory name,
--promptvalue, orVIRTUALENV_PROMPT - Trigger point: Rendering the interactive zsh prompt after environment activation
- Required shell behavior: zsh must have
PROMPT_SUBSTenabled - Why exploitation is possible: The affected script can leave expansion syntax unescaped before assigning attacker-influenced data to the prompt
- Attack surface: The generated shell activation script and the prompt value assigned to
PS1 - Required access: Ability to influence the virtual environment directory name,
--promptvalue, orVIRTUALENV_PROMPT - Trigger point: Rendering the interactive zsh prompt after environment activation
- Required shell behavior: zsh must have
PROMPT_SUBSTenabled - Why exploitation is possible: The affected script can leave expansion syntax unescaped before assigning attacker-influenced data to the prompt
Why this happens
The underlying bug is insufficient context-aware escaping of untrusted text before it is assigned to a shell prompt variable. In the affected zsh path, escaping is conditional on BASH_VERSION, so zsh may receive raw command, parameter, or arithmetic expansion syntax. When PROMPT_SUBST is enabled, zsh evaluates that syntax while drawing the prompt, mapping the issue primarily to CWE-78: Improper Neutralization of Special Elements used in an OS Command and secondarily to CWE-116: Improper Encoding or Escaping of Output.
The underlying bug is insufficient context-aware escaping of untrusted text before it is assigned to a shell prompt variable. In the affected zsh path, escaping is conditional on BASH_VERSION, so zsh may receive raw command, parameter, or arithmetic expansion syntax. When PROMPT_SUBST is enabled, zsh evaluates that syntax while drawing the prompt, mapping the issue primarily to CWE-78: Improper Neutralization of Special Elements used in an OS Command and secondarily to CWE-116: Improper Encoding or Escaping of Output.
Potential impact
- Commands may execute with the privileges of the affected user
- Shell credentials, tokens, or environment data could be exposed
- User files or development workspaces could be modified
- Subsequent commands may be influenced through shell state changes
- Commands may execute with the privileges of the affected user
- Shell credentials, tokens, or environment data could be exposed
- User files or development workspaces could be modified
- Subsequent commands may be influenced through shell state changes
General mitigation guidance
Mitigation generally focuses on treating environment names and prompt values as untrusted data across every supported shell.
Common defensive patterns include:
- Apply shell- and context-specific escaping unconditionally for zsh and bash paths
- Prefer fixed, non-interpreted prompt templates over embedding raw user-controlled values
- Disable prompt substitution where it is not required
- Restrict who can create or rename environment directories used by shared workflows
- Run development tooling with least privilege and avoid unnecessary access to sensitive data
- Use maintained virtualenv releases that contain the relevant safety correction
Mitigation generally focuses on treating environment names and prompt values as untrusted data across every supported shell.
Common defensive patterns include:
- Apply shell- and context-specific escaping unconditionally for zsh and bash paths
- Prefer fixed, non-interpreted prompt templates over embedding raw user-controlled values
- Disable prompt substitution where it is not required
- Restrict who can create or rename environment directories used by shared workflows
- Run development tooling with least privilege and avoid unnecessary access to sensitive data
- Use maintained virtualenv releases that contain the relevant safety correction
How teams detect issues like this
Organizations can look for:
- Static analysis rules identifying raw environment names or prompt values assigned to shell prompt variables
- Code review signals involving conditional escaping based on shell-specific variables
- Tests that exercise generated activation scripts under zsh with
PROMPT_SUBSTenabled - Policy checks requiring context-appropriate escaping for generated shell code
- Runtime monitoring for unexpected child processes launched by interactive shell sessions after environment activation
Organizations can look for:
- Static analysis rules identifying raw environment names or prompt values assigned to shell prompt variables
- Code review signals involving conditional escaping based on shell-specific variables
- Tests that exercise generated activation scripts under zsh with
PROMPT_SUBSTenabled - Policy checks requiring context-appropriate escaping for generated shell code
- Runtime monitoring for unexpected child processes launched by interactive shell sessions after environment activation
