CVE-2026-102925: virtualenv bash and fish activation scripts execute commands embedded in paths
Impact
The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs commands when a user sources the activation script.
activate is affected through the virtual environment's own path, on the branch that reports a relocated environment:
sh echo "Virtual environment directory VIRTUALENV does not exist!" >&2
For a destination named x'$(id)'y, shlex.quote emits 'x'"'"'$(id)'"'"'y'. The inner " closes the enclosing double quote and $(id) is left unquoted. Backtick and ; payloads reach the same result. This branch runs whenever the recorded path is absent, which is the normal case for a virtual environment copied or distributed to another machine.
activate.fish is affected through the interpreter's Tcl/Tk library paths:
fish set -gx TCLLIBRARY 'TCLLIBRARY'
shlex.quote already returns '/tcl/(cmd)/lib', so the rendered line is ''/tcl/(cmd)/lib''. fish concatenates the adjacent quoted runs and expands the (cmd) left between them. The same doubling also splits a path containing a space into two list elements, corrupting TCLLIBRARY and TKLIBRARY.
This is the same defect class as GHSA-x78j-v8h9-3j2q, which covered activate.bat.
Patches
Fixed in 21.7.13 by moving the placeholders outside the surrounding quotes, so each value keeps only the quoting shlex.quote applied. Fix: https://github.com/pypa/virtualenv/pull/3252
Workarounds
Avoid creating or distributing virtual environments whose path contains ', , $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.
Other sources
virtualenv bash and fish activation scripts execute commands embedded in paths
— Microsoft
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches VIRTUALENV when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach TCLLIBRARY or TKLIBRARY. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/virtualenvto a version that resolves this vulnerability.Fixed in 21.7.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.36.1-7 - Upgrade
Upgrade
virtualenvto a version that resolves this vulnerability.Fixed in 21.7.13 - Compensating control
Avoid creating or distributing virtual environments whose path contains ', `, $, ;, ( or ), and inspect the generated activation script before sourcing one you did not create.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users who source a generated bash, zsh, or fish activation script from a virtual environment whose relevant path values have been crafted are exposed. Successful execution occurs with the privileges of the user sourcing the script.
What interaction is required for exploitation?
An attacker must cause a user to source the affected activation script. For bash and zsh, exploitation involves a relocated environment whose recorded directory is absent; for fish, crafted Tcl or Tk library paths are involved.
Are all virtualenv activation scripts affected?
The issue affects generated activate scripts for bash and zsh and activate.fish. The described bash and zsh condition requires a relocated environment with its recorded directory absent, while the fish condition concerns Tcl or Tk library path values.
What version fixes the issue?
Upgrade virtualenv to version 21.7.13 or later. Versions prior to 21.7.13 are affected by the described quoting flaw.