---
id: CVE-2026-113732
aliases:
  - GHSA-c947-3pg5-gm8q
  - BIT-virtualenv-2026-113732
title: >-
  virtualenv activate.fish runs commands from a path or prompt with a backslash
  before a quote
summary: >-
  virtualenv activate.fish runs commands from a path or prompt with a backslash
  before a quote
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: virtualenv
product: virtualenv
ecosystem: pip
affected:
  - virtualenv < 21.14.2
patched:
  - virtualenv 21.14.2
published: '2026-10-21'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:55:30.348006947Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-c947-3pg5-gm8q'
references:
  - url: 'https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-113732'
  - url: >-
      https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab
  - url: 'https://github.com/pypa/virtualenv'
  - url: 'https://github.com/pypa/virtualenv/releases/tag/21.14.2'
  - url: 'https://github.com/advisories/GHSA-c947-3pg5-gm8q'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113732.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-113732'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2557255'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-113732'
tags:
  - osv
  - pip
  - cve.org
  - ghsa
  - csaf
  - vex
  - red-hat
epss: 0.00236
epssPercentile: 0.14687
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-27T13:26:40.567506Z'
cwe:
  - CWE-78
  - CWE-116
  - CWE-94
ingestedAt: '2026-10-20T22:23:33.690Z'
---

## Overview

### Impact

`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\'` inside single quotes as an escaped quote and `\\` as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where `shlex.quote` put the end, and fish expands the command substitution that follows.

The environment path reaches `set -gx VIRTUAL_ENV`, and `--prompt` or `VIRTUALENV_PROMPT` reaches `set -gx VIRTUAL_ENV_PROMPT`. For `--prompt "x\'\$(touch PWNED)'\'"`, the generated `activate.fish` contains:

```fish
set -gx VIRTUAL_ENV_PROMPT 'x\'"'"'$(touch PWNED)'"'"'\'"'"''
```

`source bin/activate.fish` runs `touch PWNED`, and fish prints no error. The same payload as a directory name runs through `VIRTUAL_ENV`. `--prompt .` takes the current directory's name, so running virtualenv inside a directory someone else named is enough. Without the backslash the payload runs nothing, and under bash it runs nothing either.

virtualenv generates `activate.fish` by default. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.

The bug affects every release up to 21.14.1 that ships `activate.fish`. The GHSA-p58f-9548-mpm2 fix in 21.7.13 moved the placeholders outside their quotes but kept `shlex.quote`.

### Patches

Fixed in 21.14.2. `activate.fish` now escapes backslashes and single quotes the way fish reads them, so the example above runs nothing and shows the prompt as given. Fix: https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab

### Workarounds

Do not create an environment whose path or prompt contains a backslash, and inspect `activate.fish` before you source one you did not create.

### Credits

Kevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.

## Affected packages

- `virtualenv < 21.14.2`

## Remediation

Upgrade to a patched release:

- `virtualenv 21.14.2`

## Vendor advisories

- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat Satellite 6 · no fix planned: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113732.json)