CVE-2026-113732: falha de alta gravidade em pypa virtualenv
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.2%
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
pypa · virtualenvCVEs relacionadas — pypa virtualenv
No mesmo produto, das mais perigosas para as menos.
CVE-2026-113726HIGHvirtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTEPSS 0.3%CVE-2026-113717LOWvirtualenv: Pip seeding with download omits wheel digest verificationEPSS 0.3%CVE-2026-113722HIGHvirtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxEPSS 0.3%CVE-2026-115586HIGHvirtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)EPSS 0.3%CVE-2026-113776HIGHvirtualenv activation scripts run code from a path that contains a placeholder nameEPSS 0.3%CVE-2026-113725HIGHvirtualenv bash activate runs commands from an environment name with a backslash before $EPSS 0.3%