CVE-2026-113732

HIGH 7.8

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.

CWE	CWE-78 CWE-116
Vendor	pypa
Product	virtualenv
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for pypa virtualenv

Be the first to know when new high vulnerabilities affecting pypa virtualenv are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

pypa / virtualenv

< 21.14.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q github.com: https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab github.com: https://github.com/pypa/virtualenv/releases/tag/21.14.2