Code Execution Vulnerability in virtualenv by pypa
CVE-2026-113732

7.8HIGH

Key Information:

Vendor

Pypa

Status
Virtualenv
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113732?

The virtualenv tool, designed for creating isolated Python environments, contains a code execution vulnerability prior to version 21.14.2. The FishActivator class includes a flaw where it inherits a quoting method that does not properly handle backslashes and single quotes, which are interpreted differently in the fish shell. This flaw can be exploited if an attacker influences the environment path, --prompt option, or VIRTUALENV_PROMPT value, inserting a backslash before a quote. This allows the attacker to terminate a created fish literal and execute arbitrary command substitutions when the user activates the environment. Users are advised to upgrade to version 21.14.2 to mitigate this vulnerability.

Affected Version(s)

virtualenv < 21.14.2

References

https://github.com/pypa/virtualenv/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee...
x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.2
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.