virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

影響: pip:virtualenv <= 21.14.1 → 21.14.2

FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows. The environmen…

GitHub Advisory Databaseで読む

2026/10/22 01:39、GitHub Advisory Databaseが「virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python。CVE: CVE-2026-113732。