BIT-VIRTUALENV-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

PT-2026-132503

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

SUSE CVE-2026-113732

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

Linux Distros Unpatched Vulnerability : CVE-2026-113732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX...

GHSA-C947-3PG5-GM8Q virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

Impact FishActivator defines no quote, so it inherits ViaTemplateActivator.quote, which returns shlex.quotestring. That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads ' inside single quotes as an escaped quote and \ as an escaped...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via FishActivator, which inherits shlex.quote for escaping shell arguments. The POSIX quoting rules applied by shlex.quote leave backslash characters literal inside single quotes, but the fish shell treats ' as an...

CVE-2026-113732

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

AZL-110091 CVE-2026-113732 affecting package python-virtualenv for versions less than 20.36.1-10

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

DEBIAN-CVE-2026-113732

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113732

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113732

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113732

The virtualenv tool for creating isolated Python environments is vulnerable to command injection in versions prior to 21.14.2 . The issue exists because FishActivator inherits ViaTemplateActivator.quote(), which incorrectly uses POSIX shlex.quote() for Fish shell environments. Because Fish handle...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.2. This vulnerability arises because FishActivator inherits from ViaTemplateActivator.quote and calls POSIX shlex.quote. However, fish interprets backslashes and single quotes differently. Attackers c...