CVE-2026-113732

7.8 Élevée

Publiée le 21/10/2026 à 00:19 · Modifiée le 21/10/2026 à 00:19 · Reçue · Source : security-advisories@github.com

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.

Traduire en français

Produits concernés

pypa virtualenv

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78
CWE-116

Références

https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab
https://github.com/pypa/virtualenv/releases/tag/21.14.2
https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories