CVE-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113732?
CVE-2026-113732 is a high-severity vulnerability in pypa virtualenv, published on 20 Oct 2026.
Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.
Which versions are affected by CVE-2026-113732?
3 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | All versions | 21.14.2 |
virtualenv PyPI | All versions | 21.14.2 |
virtualenv PyPI | All versions | 21.14.2 |
How do I fix CVE-2026-113732?
Upgrade virtualenv to 21.14.2 or later.
Is CVE-2026-113732 being exploited?
There is no known exploitation of CVE-2026-113732 in the wild and no public exploit code.
Sources
Also known as AZL-110091, BIT-virtualenv-2026-113732, DEBIAN-CVE-2026-113732, ECHO-8675-a321-3c8f, GHSA-c947-3pg5-gm8q, MINI-47pm-25vr-57pc and 2 more.