Does virtualenv 21.14.1 allow arbitrary code execution via crafted paths?

The short version

• virtualenv versions up to 21.14.1 contain a high severity command injection flaw.
• The bug affects activate.fish scripts when environment paths or prompts contain specific payloads.
• Version 21.14.2 fixes the issue by adjusting how backslashes and quotes are escaped.

The details

The GitHub advisory GHSA-c947-3pg5-gm8q describes a high severity vulnerability in virtualenv, tracked as CVE-2026-113732. The flaw exists in versions up to and including 21.14.1. The FishActivator component inherits a quoting method that uses standard POSIX sh rules via shlex.quote. This approach fails to account for how the fish shell interprets backslashes inside single quotes, treating them as escape characters rather than literals.

An attacker can exploit this by influencing the environment path or prompt variables. If a directory name or prompt string contains a backslash followed by a quote, the generated activate.fish script will contain malformed quoting. When a user sources this script, fish expands subsequent command substitutions, leading to arbitrary code execution. The payload runs silently without producing error messages in the shell.

The context

The vulnerability affects any release of virtualenv prior to 21.14.1 that ships activate.fish by default. A previous fix in version 21.7.13, identified as GHSA-p58f-9548-mpm2, moved placeholders outside their quotes but retained the problematic shlex.quote function. This left the escaping logic vulnerable to the specific backslash-quote sequence that fish interprets differently than bash.

Attackers need only influence the environment path or prompt to trigger the exploit. This could occur in CI jobs that pass branch or project names through the tool, or when unpacking archives containing maliciously named directories. Running virtualenv inside a directory with a crafted name is sufficient to generate the compromised script.

Next steps

Users should upgrade virtualenv to version 21.14.2 immediately. This release corrects the escaping logic for backslashes and single quotes in activate.fish, ensuring the fish shell processes them as intended. Until patched, teams can mitigate risk by avoiding environment paths or prompts that contain backslashes.

Inspect any activate.fish script before sourcing it, particularly if it was generated from untrusted sources or cloned repositories. Do not source scripts from environments whose paths or prompts you did not create or verify. This manual check helps prevent accidental execution of injected commands.

What defenders should look for

Teams usually monitor for unexpected file creation or command execution within build agents and developer workstations. Check whether activate scripts contain unusual quoting patterns or embedded command substitutions. Look for shell variables being set to values derived from user input or directory names. Contain the issue by isolating affected containers or virtual machines and reviewing recent virtualenv installations for suspicious prompt configurations.

What to do and how to stay safe: virtualenv

• Upgrade virtualenv to version 21.14.2 or later to apply the official patch.
• Avoid creating virtual environments in directories with names containing backslashes or quotes.
• Inspect activate.fish files for unexpected command substitutions before sourcing them.
• Monitor CI pipelines for jobs that pass untrusted strings into virtualenv prompts.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of virtualenv are affected by CVE-2026-113732?

All versions up to and including 21.14.1 are vulnerable.

Is there a patch available for this vulnerability?

Yes, version 21.14.2 fixes the issue.

Does this affect bash environments?

No, the payload runs nothing under bash; it is specific to fish shell.