virtualenv EUVD-2026-106866

Exploitation requires ALL of: (1) the victim uses the fish shell and sources the generated bin/activate.fish; (2) the attacker controls or influences the virtual environment directory path, the --prompt argument, or the VIRTUALENV_PROMPT environment variable; and (3) that attacker-controlled value contains a backslash immediately before a quote, which prematurely terminates the fish single-quoted literal and injects fish command substitution. The flaw exists specifically because FishActivator reused ViaTemplateActivator.quote()/shlex.quote(), which is POSIX-correct but unsafe for fish's distinct backslash and single-quote escaping. Limiting factors: no effect on bash/zsh/other activators, no impact for fish users who never source a maliciously-named/prompted environment, requires local user interaction (sourcing), and is remediated entirely by upgrading to virtualenv 21.14.2. No special condition applies to default configs where the venv path and prompt are fully operator-controlled and untrusted input never reaches them.

This is a genuine but conditionally-gated code-injection flaw (CWE-78) rather than a mass-exploitable remote vulnerability. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: exploitation is local (AV:L) and requires the victim to source the generated activate.fish (UI:R), with no attacker privileges needed (PR:N) and full compromise of the user's account context (C:H/I:H/A:H). No EPSS score, CISA KEV entry, or standalone public exploit is present in the supplied intelligence, so there is no evidence of active or widespread exploitation - this signal set points to a high-CVSS-but-low-immediate-real-world-risk issue whose impact is bounded by three conditions that must coincide: the victim uses the fish shell, the attacker can influence the environment directory name, --prompt, or VIRTUALENV_PROMPT, and the victim activates the environment. The one amplifying signal is that the vendor's own fix commit ships a working regression payload (x\'$(touch PWNED)'\'), so a functional exploit technique is effectively public even though no POC was flagged in the input - treat weaponization as low-effort for an attacker who can seed a malicious directory/prompt. Overall: a real priority for fish-shell users in automation/CI contexts that build virtualenvs from untrusted names, but not an internet-facing emergency.

An attacker who can influence a directory name, the --prompt argument, or the VIRTUALENV_PROMPT value (for example via a CI job, a cloned repo, or an archive that dictates the venv path) embeds a backslash-before-quote sequence that breaks out of the generated fish single-quoted literal. When a fish-shell user later runs source bin/activate.fish, the smuggled fish command substitution executes arbitrary commands as that user. The vendor fix commit demonstrates the exact technique, so the method is public even though no packaged exploit was reported.