OS Command Injection in py3-virtualenv - CVE-2026-113732
Published: November 9, 2026
Vulnerability identifier: #VU163138
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-113732
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unprivileged local attacker to execute arbitrary commands with the victim's privileges.
The vulnerability exists due to POSIX shell quoting in virtualenv's fish activation script, which mishandles environment paths or prompts containing a backslash before a quote. An unprivileged local attacker can supply a crafted environment path or prompt that triggers command substitution when the victim sources the generated bin/activate.fish script in fish.
Affected software
py3-virtualenv
How to mitigate CVE-2026-113732
Install security update from vendor's website.
py3-virtualenv - update to 21.14.2