CVE-2026-113732

Awaiting Analysis Awaiting Analysis - Queue

Fish Command Injection in virtualenv via FishActivator

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113732

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This vulnerability affects virtualenv, a tool for creating isolated Python environments. In versions before 21.14.2, the FishActivator component inherits a quoting method that uses POSIX shlex.quote(), which is unsafe for Fish shell. An attacker can craft a malicious path, prompt, or environment variable containing a backslash before a quote to execute arbitrary commands when the user sources the activate.fish script.

Detection Guidance

Check if virtualenv version is below 21.14.2 using pip show virtualenv or pip list. Inspect FishActivator files for backslash handling in paths or prompts.

Impact Analysis

If you use virtualenv with Fish shell and versions prior to 21.14.2, an attacker could execute arbitrary commands on your system by tricking you into sourcing a malicious activate.fish script. This could lead to full system compromise, data theft, or further attacks depending on your environment.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is accessed or exfiltrated. Compliance may be impacted if the vulnerability results in data breaches or unauthorized system access.

Mitigation Strategies

Upgrade virtualenv to version 21.14.2 or later using pip install --upgrade virtualenv. Avoid using untrusted --prompt or VIRTUALENV_PROMPT values containing backslashes.

Hi! I’m here to help you understand CVE-2026-113732. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...