virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

影響: pip:virtualenv <= 21.14.1 → 21.14.2

FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows. The environmen…

Read on GitHub Advisory Database

On 10/22/2026, 01:39 AM, GitHub Advisory Database published "virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-113732.