Summary
A command injection vulnerability in virtualenv's Fish shell activator can arise when attacker-influenced paths or prompt values are improperly quoted for Fish syntax. If a user sources the generated activate.fish script containing a crafted backslash-and-quote sequence, command substitution may execute with the user's shell privileges.
A command injection vulnerability in virtualenv's Fish shell activator can arise when attacker-influenced paths or prompt values are improperly quoted for Fish syntax. If a user sources the generated activate.fish script containing a crafted backslash-and-quote sequence, command substitution may execute with the user's shell privileges.
Affected context
The issue affects virtualenv environments using the Fish shell activator when an environment path, --prompt value, or VIRTUALENV_PROMPT value can be influenced by an attacker. Risk exists because the activator generates shell code using quoting behavior intended for POSIX shells, while Fish interprets backslashes and single quotes differently. Exploitation requires the generated activation script to be sourced by a user.
The issue affects virtualenv environments using the Fish shell activator when an environment path, --prompt value, or VIRTUALENV_PROMPT value can be influenced by an attacker. Risk exists because the activator generates shell code using quoting behavior intended for POSIX shells, while Fish interprets backslashes and single quotes differently. Exploitation requires the generated activation script to be sourced by a user.
Exploit preconditions
- Attack surface: Generated Fish shell activation script
- Required access: Ability to influence the virtual environment path or prompt-related configuration
- Trigger point: A user sources the resulting
activate.fishscript - Why exploitation is possible: The activator applies POSIX
shlex.quote()escaping to values interpreted under Fish syntax, allowing crafted characters to alter the generated command structure and trigger command substitution
- Attack surface: Generated Fish shell activation script
- Required access: Ability to influence the virtual environment path or prompt-related configuration
- Trigger point: A user sources the resulting
activate.fishscript - Why exploitation is possible: The activator applies POSIX
shlex.quote()escaping to values interpreted under Fish syntax, allowing crafted characters to alter the generated command structure and trigger command substitution
Why this happens
The underlying bug is a shell-context mismatch in output escaping. FishActivator inherits quoting behavior designed for POSIX shell syntax, but Fish has different parsing rules for backslashes and single quotes. Consequently, data that appears escaped for one shell can become executable syntax in another, mapping to CWE-78: Improper Neutralization of Special Elements used in an OS Command and CWE-116: Improper Encoding or Escaping of Output.
The underlying bug is a shell-context mismatch in output escaping. FishActivator inherits quoting behavior designed for POSIX shell syntax, but Fish has different parsing rules for backslashes and single quotes. Consequently, data that appears escaped for one shell can become executable syntax in another, mapping to CWE-78: Improper Neutralization of Special Elements used in an OS Command and CWE-116: Improper Encoding or Escaping of Output.
Potential impact
- Execution of attacker-controlled commands in the user's shell context
- Exposure or modification of files accessible to that user
- Theft of environment variables, credentials, or tokens available to the shell
- Modification of the virtual environment or project files
- Potential lateral movement if the affected user has broader system access
- Execution of attacker-controlled commands in the user's shell context
- Exposure or modification of files accessible to that user
- Theft of environment variables, credentials, or tokens available to the shell
- Modification of the virtual environment or project files
- Potential lateral movement if the affected user has broader system access
General mitigation guidance
Mitigation generally focuses on generating shell-specific code with shell-specific escaping rules and minimizing trust in values embedded into activation scripts.
Common defensive patterns include:
- Use a Fish-aware quoting or escaping routine for every value inserted into Fish scripts
- Prefer structured activation mechanisms that avoid embedding untrusted data in executable shell source
- Validate and constrain environment paths and prompt values before code generation
- Treat environment metadata and prompt configuration as untrusted input
- Run development and automation workflows with least-privilege accounts and limited credentials
- Review generated activation scripts before sourcing them when values originate outside trusted project controls
Mitigation generally focuses on generating shell-specific code with shell-specific escaping rules and minimizing trust in values embedded into activation scripts.
Common defensive patterns include:
- Use a Fish-aware quoting or escaping routine for every value inserted into Fish scripts
- Prefer structured activation mechanisms that avoid embedding untrusted data in executable shell source
- Validate and constrain environment paths and prompt values before code generation
- Treat environment metadata and prompt configuration as untrusted input
- Run development and automation workflows with least-privilege accounts and limited credentials
- Review generated activation scripts before sourcing them when values originate outside trusted project controls
How teams detect issues like this
Organizations can detect similar issues through:
- Static analysis rules that identify shell code generation from externally influenced values
- Checks for reuse of POSIX escaping functions in Fish or other non-POSIX shell output
- Code review of activator templates, quoting helpers, and interpolation boundaries
- Tests using shell-specific metacharacters, backslashes, quotes, and command-substitution syntax
- Repository policies requiring shell-language-aware escaping and security tests for generated scripts
- Automated security review tools that flag possible command injection and output-encoding mismatches
Organizations can detect similar issues through:
- Static analysis rules that identify shell code generation from externally influenced values
- Checks for reuse of POSIX escaping functions in Fish or other non-POSIX shell output
- Code review of activator templates, quoting helpers, and interpolation boundaries
- Tests using shell-specific metacharacters, backslashes, quotes, and command-substitution syntax
- Repository policies requiring shell-language-aware escaping and security tests for generated scripts
- Automated security review tools that flag possible command injection and output-encoding mismatches
