CVE-2026-113732: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in pypa virtualenv

The vulnerability in pypa virtualenv (before 21.14.2) involves improper neutralization of special elements used in OS commands (CWE-78). Specifically, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() for quoting strings. However, Fish shell interprets backslashes and single quotes differently than POSIX shells. If an attacker controls environment variables such as the environment path, --prompt option, or VIRTUALENV_PROMPT and includes a backslash before a quote, this can prematurely terminate the quoted string in the generated activate.fish script. This allows execution of arbitrary commands via command substitution when the user sources the activate.fish script. The issue is resolved in virtualenv version 21.14.2.

Successful exploitation can lead to arbitrary command execution with the privileges of the user sourcing the activate.fish script. This can result in full compromise of the user's environment, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H). The attack requires user interaction (sourcing the script) and local access to influence environment variables or command-line options.

Upgrade virtualenv to version 21.14.2 or later, where this vulnerability is fixed. No other mitigations are specified or recommended by the vendor. Users should avoid sourcing activate.fish scripts generated by vulnerable versions with untrusted environment variables or prompts.