{"id":"CVE-2026-113732","aliases":["GHSA-c947-3pg5-gm8q"],"url":"https://o3.security/vulnerability/CVE-2026-113732","summary":"virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote","details":"### Impact\n\n`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\\'` inside single quotes as an escaped quote and `\\\\` as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where `shlex.quote` put the end, and fish expands the command substitution that follows.\n\nThe environment path reaches `set -gx VIRTUAL_ENV`, and `--prompt` or `VIRTUALENV_PROMPT` reaches `set -gx VIRTUAL_ENV_PROMPT`. For `--prompt \"x\\'\\$(touch PWNED)'\\'\"`, the generated `activate.fish` contains:\n\n```fish\nset -gx VIRTUAL_ENV_PROMPT 'x\\'\"'\"'$(touch PWNED)'\"'\"'\\'\"'\"''\n```\n\n`source bin/activate.fish` runs `touch PWNED`, and fish prints no error. The same payload as a directory name runs through `VIRTUAL_ENV`. `--prompt .` takes the current directory's name, so running virtualenv inside a directory someone else named is enough. Without the backslash the payload runs nothing, and under bash it runs nothing either.\n\nvirtualenv generates `activate.fish` by default. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n\nThe bug affects every release up to 21.14.1 that ships `activate.fish`. The GHSA-p58f-9548-mpm2 fix in 21.7.13 moved the placeholders outside their quotes but kept `shlex.quote`.\n\n### Patches\n\nFixed in 21.14.2. `activate.fish` now escapes backslashes and single quotes the way fish reads them, so the example above runs nothing and shows the prompt as given. Fix: https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab\n\n### Workarounds\n\nDo not create an environment whose path or prompt contains a backslash, and inspect `activate.fish` before you source one you did not create.\n\n### Credits\n\nKevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.","published":"2026-10-20T22:01:23.931Z","modified":"2026-10-24T02:48:20.789302923Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"virtualenv","fixedVersion":"21.14.2"}],"fix":{"url":"https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab","label":"pypa/virtualenv@3bddeaf"},"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113732.json"},{"type":"ADVISORY","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113732"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:48:20.789302923Z"}}