{"schema":"threatline.record/2","record":{"id":"CVE-2026-113732","aliases":["GHSA-c947-3pg5-gm8q"],"summary":"virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote","details":"### Impact\n\n`FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\\'` inside single quotes as an escaped quote and `\\\\` as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where `shlex.quote` put the end, and fish expands the command substitution that follows.\n\nThe environment path reaches `set -gx VIRTUAL_ENV`, and `--prompt` or `VIRTUALENV_PROMPT` reaches `set -gx VIRTUAL_ENV_PROMPT`. For `--prompt \"x\\'\\$(touch PWNED)'\\'\"`, the generated `activate.fish` contains:\n\n```fish\nset -gx VIRTUAL_ENV_PROMPT 'x\\'\"'\"'$(touch PWNED)'\"'\"'\\'\"'\"''\n```\n\n`source bin/activate.fish` runs `touch PWNED`, and fish prints no error. The same payload as a directory name runs through `VIRTUAL_ENV`. `--prompt .` takes the current directory's name, so running virtualenv inside a directory someone else named is enough. Without the backslash the payload runs nothing, and under bash it runs nothing either.\n\nvirtualenv generates `activate.fish` by default. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.\n\nThe bug affects every release up to 21.14.1 that ships `activate.fish`. The GHSA-p58f-9548-mpm2 fix in 21.7.13 moved the placeholders outside their quotes but kept `shlex.quote`.\n\n### Patches\n\nFixed in 21.14.2. `activate.fish` now escapes backslashes and single quotes the way fish reads them, so the example above runs nothing and shows the prompt as given. Fix: https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab\n\n### Workarounds\n\nDo not create an environment whose path or prompt contains a backslash, and inspect `activate.fish` before you source one you did not create.\n\n### Credits\n\nKevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.","categories":["Libraries & packages"],"product":"virtualenv","vendor":"pypa","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c947-3pg5-gm8q","source_modified_at":"2026-10-21T16:39:59Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"virtualenv"},"range":"<= 21.14.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113732","source_modified_at":"2026-10-20T22:01:23.931Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"virtualenv","vendor":"pypa","versions":[{"version":"< 21.14.2","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c947-3pg5-gm8q","source_modified_at":"2026-10-21T17:00:06.342515233Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"virtualenv","purl":"pkg:pypi/virtualenv"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"21.14.2"}],"type":"ECOSYSTEM"}],"versions":["0.8","0.8.1","0.8.2","0.8.3","0.8.4","0.9","0.9.1","0.9.2","1.0","1.1","1.10","1.10.1","1.11","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.2","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.4","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.4rc1","1.5","1.5.1","1.5.2","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.1.1","1.7.1.2","1.7.2","1.8"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c947-3pg5-gm8q","source_modified_at":"2026-10-21T16:39:59Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"virtualenv"},"version":"21.14.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c947-3pg5-gm8q","source_modified_at":"2026-10-21T17:00:06.342515233Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"virtualenv","purl":"pkg:pypi/virtualenv"},"version":"21.14.2"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00211,"percentile":0.10776,"score_date":"2026-10-23"},"published_at":"2026-10-20T22:01:23.931Z","modified_at":"2026-10-21T17:00:06.342515233Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-c947-3pg5-gm8q","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-21T16:39:59Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-113732","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T22:01:23.931Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-c947-3pg5-gm8q","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-21T17:00:06.342515233Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113732","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113732","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.2","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-c947-3pg5-gm8q","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T17:00:06.342515233Z","content_hash":"1c04ecdec10f39974acd9bde5e6c9b591b93e7a5c9bdab7cdfa36293191f9ea7"}}