AZL-110091

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110091.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-110091

Upstream

CVE-2026-113732

Published

2026-10-20T22:19:30Z

Modified

2026-10-23T14:16:39Z

Summary

CVE-2026-113732 affecting package python-virtualenv 20.36.1-6

Details

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-113732

Affected packages

Azure Linux:3 / python-virtualenv

Package

Name: python-virtualenv
Purl: pkg:rpm/azure-linux/python-virtualenv

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

20.36.1-6

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110091.json"