VDB
CVE-2026-113732
CVE-2026-113732
PUBLISHED
CVSS 7.8 HIGH
Reported by GitHub_M · Published October 20, 2026
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.
Risk Scores
CVSS 3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pypa | virtualenv | < 21.14.2 |
| pypa | virtualenv | 0 |
| chainguard | openstack-rally-2026.1 | 0 |
| PyPI | virtualenv | 0 |
| chainguard | openstack-rally-2025.2 | 0 |
Timeline
- Oct 20, 2026 CVE Published
- Oct 21, 2026 EPSS Score
- Oct 21, 2026 Coalition ESS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 CVE Updated
- Oct 29, 2026 EPSS Score
- Oct 31, 2026 Security Advisory
References
- https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q x_refsource_CONFIRM
- https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab x_refsource_MISC
- https://github.com/pypa/virtualenv/releases/tag/21.14.2 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-113732 advisory
- https://github.com/advisories/GHSA-c947-3pg5-gm8q advisory