{"id":"CVE-2026-102925","aliases":["BIT-virtualenv-2026-102925","GHSA-p58f-9548-mpm2","PYSEC-2026-4013"],"url":"https://o3.security/vulnerability/CVE-2026-102925","summary":"virtualenv bash and fish activation scripts execute commands embedded in paths","details":"### Impact\n\nThe generated `activate` (bash/zsh) and `activate.fish` scripts interpolate a `shlex.quote`-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.\n\n`activate` is affected through the virtual environment's own path, on the branch that reports a relocated environment:\n\n```sh\necho \"Virtual environment directory __VIRTUAL_ENV__ does not exist!\" >&2\n```\n\nFor a destination named `x'$(id)'y`, `shlex.quote` emits `'x'\"'\"'$(id)'\"'\"'y'`. The inner `\"` closes the enclosing double quote and `$(id)` is left unquoted. Backtick and `;` payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.\n\n`activate.fish` is affected through the interpreter's Tcl/Tk library paths:\n\n```fish\nset -gx TCL_LIBRARY '__TCL_LIBRARY__'\n```\n\n`shlex.quote` already returns `'/tcl/(cmd)/lib'`, so the rendered line is `''/tcl/(cmd)/lib''`. fish concatenates the adjacent quoted runs and expands the `(cmd)` left between them. The same doubling also splits a path containing a space into two list elements, corrupting `TCL_LIBRARY` and `TK_LIBRARY`.\n\nThis is the same defect class as GHSA-x78j-v8h9-3j2q, which covered `activate.bat`.\n\n### Patches\n\nFixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting `shlex.quote` applied. Fix: https://github.com/pypa/virtualenv/pull/3252\n\n### Workarounds\n\nAvoid creating or distributing virtual environments whose path contains `'`, `` ` ``, `$`, `;`, `(` or `)`, and inspect the generated activation script before sourcing one you did not create.","published":"2026-09-29T20:50:57.199Z","modified":"2026-10-21T02:54:29.968368623Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"virtualenv","fixedVersion":"21.7.13"}],"fix":{"url":"https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6","label":"pypa/virtualenv@4d5a105"},"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.7.13"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102925.json"},{"type":"ADVISORY","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102925"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/pull/3252"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4013.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://pypi.org/project/virtualenv"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:54:29.968368623Z"}}