Fluid Attacks Database

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	virtualenv	>=0 <21.14.2	21.14.2
debian 12	python-virtualenv	=20.17.1+ds-1 \|\| =20.19.0+ds-1 \|\| =20.21.0+ds-1 \|\| =20.23.0+ds-1 \|\| =20.23.0+ds-2 \|\| =20.24.1+ds-1 \|\| =20.24.6+ds-1 \|\| =20.24.6+ds-2 \|\| =20.25.0+ds-1 \|\| =20.25.0+ds-2 \|\| =20.25.1+ds-1 \|\| =20.26.1+ds-1 \|\| =20.26.2+ds-1 \|\| =20.26.6+ds-1 \|\| =20.27.0+ds-1 \|\| =20.28.0+ds-1 \|\| =20.29.1+ds-1 \|\| =20.29.3+ds-1 \|\| =20.30.0+ds-1 \|\| =20.30.0+ds-2 \|\| =20.30.0+ds-3 \|\| =20.31.2+ds-1 \|\| =20.33.1+ds-1 \|\| =20.34.0+ds-1 \|\| =20.35.3+ds-1 \|\| =20.35.4+ds-1 \|\| =20.36.1+ds-1 \|\| =20.38.0+ds-1 \|\| =21.2.0+ds-1 \|\| =21.2.4+ds-1 \|\| =21.3.1+ds-1 \|\| =21.4.1+ds-1 \|\| =21.5.1+ds-1	-
debian 14	python-virtualenv	=20.31.2+ds-1 \|\| =20.33.1+ds-1 \|\| =20.34.0+ds-1 \|\| =20.35.3+ds-1 \|\| =20.35.4+ds-1 \|\| =20.36.1+ds-1 \|\| =20.38.0+ds-1 \|\| =21.2.0+ds-1 \|\| =21.2.4+ds-1 \|\| =21.3.1+ds-1 \|\| =21.4.1+ds-1 \|\| =21.5.1+ds-1	-
debian 13	python-virtualenv	=20.31.2+ds-1 \|\| =20.31.2+ds-1+deb13u1 \|\| =20.33.1+ds-1 \|\| =20.34.0+ds-1 \|\| =20.35.3+ds-1 \|\| =20.35.4+ds-1 \|\| =20.36.1+ds-1 \|\| =20.38.0+ds-1 \|\| =21.2.0+ds-1 \|\| =21.2.4+ds-1 \|\| =21.3.1+ds-1 \|\| =21.4.1+ds-1 \|\| =21.5.1+ds-1	-

Aliases

1. CVE-2026-1137322. NVD-2026-1137323. OSV-2026-1137324. OSV-DEBIAN-2026-1137325. GHSA-c947-3pg5-gm8q6. GCVE-2026-1137327. SECURITY-TRACKER-CVE-2026-113732

References

1. https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q2. https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab3. https://github.com/pypa/virtualenv/releases/tag/21.14.2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.