CVE-2026-113732: virtualenv Command Injection Vulnerability in activate.fish
Summary
CVE-2026-113732: virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote. Affects virtualenv versions < 21.14.2. Fixed in 21.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
virtualenv is a popular Python package that allows users to create isolated Python environments, enabling them to manage dependencies for different projects without conflicts. It is widely used in the Python community for its simplicity and effectiveness in handling project-specific packages. However, a vulnerability in the activate.fish script can lead to command injection, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the FishActivator class in virtualenv, which inherits a quoting method from ViaTemplateActivator that does not handle backslashes correctly. Specifically, when a backslash precedes a quote in the prompt or environment path, it can lead to unintended command execution. For example, a prompt like '--prompt "x'$(touch PWNED)''' can result in the execution of arbitrary commands when the activate.fish script is sourced, allowing attackers to manipulate the environment and execute malicious commands without detection.
How To Fix
Latest published version: 21.14.12 as of 22 Oct 2026
pip install --upgrade "virtualenv==21.14.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.14.2
This is the first release that contains the fix.
pip install --upgrade "virtualenv==21.14.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid creating virtual environments with paths or prompts that include backslashes. Additionally, inspect the generated activate.fish script before sourcing it to ensure it does not contain any malicious commands.
Conclusion
The CVE-2026-113732 vulnerability in virtualenv poses a significant risk due to its potential for command injection through the activate.fish script. Users are strongly advised to update to the patched version 21.14.2 and follow best practices to mitigate the risk until they can ensure their environments are secure.
See every vulnerability recorded for virtualenv →
FAQ
The vulnerability allows attackers to execute arbitrary commands by manipulating the prompt or environment path, potentially leading to unauthorized access or data loss.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
All versions of virtualenv up to and including 21.14.1 are affected by this vulnerability. The issue is fixed in version 21.14.2.
If updating is not possible, ensure that you do not create environments with backslashes in their paths or prompts and manually inspect the activate.fish script before use.
The CVSS score for this vulnerability is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for virtualenv.
