Is CVE-2026-113732 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113732 being exploited in the wild.

How severe is CVE-2026-113732?

High severity, with a CVSS score of 7.8, published 20 October 2026.

Which products and versions are affected?

Pypa Virtualenv before 21.14.2; virtualenv (PyPI) <= 21.14.1, ECOSYSTEM:introduced=0,fixed=21.14.2.

Is there a fix for CVE-2026-113732?

Yes. virtualenv (PyPI): upgrade to 21.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113732 attacked?

It is attacked with local access.

Am I affected by CVE-2026-113732?

Check whether you run Pypa Virtualenv or virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113732: virtualenv command injection in Fish shell activation script

Q: Is there a fix for CVE-2026-113732?

Yes. virtualenv (PyPI): upgrade to 21.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-113732 attacked?

It is attacked with local access.

Q: Am I affected by CVE-2026-113732?

Check whether you run Pypa Virtualenv or virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113732 · Severity: high · CVSS 7.8 · Published 2026-10-20

virtualenv is a Python tool that creates isolated development environments. Prior to version 21.14.2, attackers can inject commands into the Fish shell activation script by embedding a backslash before a quote in a virtual environment path, --prompt argument, or environment variable. When users activate the virtual environment, malicious commands execute with their privileges.

Technologies: Pypa Virtualenv, virtualenv (PyPI). Vendors: Pypa, PyPI.

Quick answers

Is CVE-2026-113732 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113732 being exploited in the wild.
How severe is CVE-2026-113732?: High severity, with a CVSS score of 7.8, published 20 October 2026.
Which products and versions are affected?: Pypa Virtualenv before 21.14.2; virtualenv (PyPI) <= 21.14.1, ECOSYSTEM:introduced=0,fixed=21.14.2.
Is there a fix for CVE-2026-113732?: Yes. virtualenv (PyPI): upgrade to 21.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113732 attacked?: It is attacked with local access.
Am I affected by CVE-2026-113732?: Check whether you run Pypa Virtualenv or virtualenv (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

virtualenv (PyPI): upgrade to 21.14.2 or later
```
pip install "virtualenv>=21.14.2"
```

Technical details

FishActivator used POSIX shlex.quote() to escape environment paths and prompts, but Fish shell interprets backslashes and single quotes differently than POSIX shells. An attacker-controlled path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can terminate the generated shell literal and execute arbitrary command substitution when activate.fish is sourced. The fix adds Fish-specific quote escaping in FishActivator.

Affected products

pypa virtualenv before 21.14.2

Identifiers

CVE-2026-113732
GHSA-c947-3pg5-gm8q

Timeline

2026-10-20: disclosed: Published on NVD
2026-10-01: patched: Fixed in 21.14.2 release

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.