CVE-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113732

The virtualenv tool for creating isolated Python environments is vulnerable to command injection in versions prior to 21.14.2 . The issue exists because FishActivator inherits ViaTemplateActivator.quote(), which incorrectly uses POSIX shlex.quote() for Fish shell environments. Because Fish handle...