virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

影響: pip:virtualenv <= 21.14.1 → 21.14.2

FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows. The environmen…

在 GitHub Advisory Database 阅读

2026/10/22 01:39，GitHub Advisory Database 发布了“virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-113732。