Live › vulnerability › CVE-2026-113732
Go to dashboardvirtualenv's generated activate.fish script quotes the environment path and prompt with POSIX shlex rules, which fish reads differently, so a crafted path or prompt containing a backslash before a quote breaks out of the quoting. An attacker who controls a directory name or prompt value can get arbitrary shell commands run when a user sources activate.fish.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| virtualenv | pypi | <= 21.14.1 | 21.14.2 |
Check the installed version with pip show virtualenv and treat anything at or below 21.14.1 as affected.
For environments created by you or your CI, grep activate.fish for set -gx VIRTUAL_ENV and VIRTUAL_ENV_PROMPT and look for unexpected $( ) content.
21.14.2 or later and recreate fish environments with itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows.
The environment path reaches set -gx VIRTUAL_ENV, and --prompt or VIRTUALENV_PROMPT reaches set -gx VIRTUAL_ENV_PROMPT. For --prompt "x\'\$(touch PWNED)'\'", the generated activate.fish contains:
set -gx VIRTUAL_ENV_PROMPT 'x\'"'"'$(touch PWNED)'"'"'\'"'"''
source bin/activate.fish runs touch PWNED, and fish prints no error. The same payload as a directory name runs through VIRTUAL_ENV. --prompt . takes the current directory's name, so running virtualenv inside a directory someone else named is enough. Without the backslash the payload runs nothing, and under bash it runs nothing either.
virtualenv generates activate.fish by default. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.
The bug affects every release up to 21.14.1 that ships activate.fish. The GHSA-p58f-9548-mpm2 fix in 21.7.13 moved the placeholders outside their quotes but kept shlex.quote.
Fixed in 21.14.2. activate.fish now escapes backslashes and single quotes the way fish reads them, so the example above runs nothing and shows the prompt as given. Fix: https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab
Do not create an environment whose path or prompt contains a backslash, and inspect activate.fish before you source one you did not create.
Kevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-113732")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.