[ CVE-2026-102938 · Published 29 Sep 2026 ]
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
[ Description ]Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.
[ Fixes ]Fixes and patches
- virtualenv 21.7.11Fixed version · GitHub Advisories · pip package virtualenv: upgrade to 21.7.11 or later (affected <= 21.7.10)
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-4111
Red Hat Ansible Automation Platform: Multiple vulnerabilities Translated from German
[ Packages ]Affected open-source packages
- virtualenv pipAffected <= 21.7.10 · fixed in 21.7.11 · GHSA-9h9j-4vrj-gf7g