Action not permitted
Modal body text goes here.
Modal Title
Modal Body
GHSA-9H9J-4VRJ-GF7G
Vulnerability from github – Published: 2026-09-30 23:53 – Updated: 2026-09-30 23:53Summary
pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while PyEnvCfg._read_values() parses the file with str.splitlines(). A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.
Impact
The prompt value is the reachable input: it is set by --prompt, by the VIRTUALENV_PROMPT environment variable, or from the config file, and write() emits prompt before home. A crafted prompt can therefore set home in the generated pyvenv.cfg:
$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path
home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.
This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited VIRTUALENV_PROMPT. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.
Details
The boundary set is the one str.splitlines() recognizes, which is wider than \n: \r, \v, \f, the file, group and record separators, U+0085, U+2028 and U+2029 were all written through unchanged and all split the line when read back.
Patches
PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.
Workarounds
Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as --prompt or VIRTUALENV_PROMPT.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 21.7.10"
},
"package": {
"ecosystem": "PyPI",
"name": "virtualenv"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.7.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-102938"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-30T23:53:58Z",
"nvd_published_at": "2026-09-29T21:17:19Z",
"severity": "MODERATE"
},
"details": "### Summary\n\n`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.\n\n### Impact\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:\n\n```console\n$ virtualenv --prompt $\u0027x\"\\nhome = /attacker/path\\nprompt = \"z\u0027 venv\n$ grep \u0027^home\u0027 venv/pyvenv.cfg\nhome = /attacker/path\n```\n\n`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.\n\nThis requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.\n\n### Details\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than `\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.\n\n### Patches\n\n`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.\n\n### Workarounds\n\nDo not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.",
"id": "GHSA-9h9j-4vrj-gf7g",
"modified": "2026-09-30T23:53:58Z",
"published": "2026-09-30T23:53:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102938"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection"
}
BREW-CHARM-TOOLS-CVE-202… (GHSA-9H9J-4VRJ-GF7G)
Vulnerability from osv_homebrew – Published: 2026-10-01 08:54 – Updated: 2026-10-04 15:51 – Source websiteSummary
pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while PyEnvCfg._read_values() parses the file with str.splitlines(). A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.
Impact
The prompt value is the reachable input: it is set by --prompt, by the VIRTUALENV_PROMPT environment variable, or from the config file, and write() emits prompt before home. A crafted prompt can therefore set home in the generated pyvenv.cfg:
$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path
home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.
This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited VIRTUALENV_PROMPT. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.
Details
The boundary set is the one str.splitlines() recognizes, which is wider than \n: \r, \v, \f, the file, group and record separators, U+0085, U+2028 and U+2029 were all written through unchanged and all split the line when read back.
Patches
PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.
Workarounds
Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as --prompt or VIRTUALENV_PROMPT.
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@20.39.1",
"upstream_fixed_in": "21.7.11"
},
"package": {
"ecosystem": "Homebrew",
"name": "charm-tools",
"purl": "pkg:brew/charm-tools"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@20.39.1",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "20.39.1"
}
]
},
"details": "### Summary\n\n`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.\n\n### Impact\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:\n\n```console\n$ virtualenv --prompt $\u0027x\"\\nhome = /attacker/path\\nprompt = \"z\u0027 venv\n$ grep \u0027^home\u0027 venv/pyvenv.cfg\nhome = /attacker/path\n```\n\n`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.\n\nThis requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.\n\n### Details\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than `\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.\n\n### Patches\n\n`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.\n\n### Workarounds\n\nDo not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.",
"id": "BREW-charm-tools-CVE-2026-102938",
"modified": "2026-10-04T15:51:22Z",
"published": "2026-10-01T08:54:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102938"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",
"upstream": [
"GHSA-9h9j-4vrj-gf7g",
"CVE-2026-102938",
"PYSEC-2026-4012"
]
}
BREW-CLOUDISCOVERY-CVE-2… (PYSEC-2026-4012)
Vulnerability from osv_homebrew – Published: 2026-09-30 21:05 – Updated: 2026-10-01 11:09 – Source websiteSummary
pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while PyEnvCfg._read_values() parses the file with str.splitlines(). A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.
Impact
The prompt value is the reachable input: it is set by --prompt, by the VIRTUALENV_PROMPT environment variable, or from the config file, and write() emits prompt before home. A crafted prompt can therefore set home in the generated pyvenv.cfg:
$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path
home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.
This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited VIRTUALENV_PROMPT. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.
Details
The boundary set is the one str.splitlines() recognizes, which is wider than \n: \r, \v, \f, the file, group and record separators, U+0085, U+2028 and U+2029 were all written through unchanged and all split the line when read back.
Patches
PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.
Workarounds
Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as --prompt or VIRTUALENV_PROMPT.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@20.31.2",
"upstream_fixed_in": "21.7.11"
},
"package": {
"ecosystem": "Homebrew",
"name": "cloudiscovery",
"purl": "pkg:brew/cloudiscovery"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.4_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@20.31.2",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "20.31.2"
}
]
},
"details": "### Summary\n\n`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.\n\n### Impact\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:\n\n```console\n$ virtualenv --prompt $\u0027x\"\\nhome = /attacker/path\\nprompt = \"z\u0027 venv\n$ grep \u0027^home\u0027 venv/pyvenv.cfg\nhome = /attacker/path\n```\n\n`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.\n\nThis requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.\n\n### Details\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than `\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.\n\n### Patches\n\n`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.\n\n### Workarounds\n\nDo not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.",
"id": "BREW-cloudiscovery-CVE-2026-102938",
"modified": "2026-10-01T11:09:02Z",
"published": "2026-09-30T21:05:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102938"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",
"upstream": [
"PYSEC-2026-4012",
"CVE-2026-102938",
"GHSA-9h9j-4vrj-gf7g"
]
}
BREW-CONDA-LOCK-CVE-2026… (GHSA-9H9J-4VRJ-GF7G)
Vulnerability from osv_homebrew – Published: 2026-10-04 19:25 – Updated: 2026-10-04 19:25 – Source websiteSummary
pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while PyEnvCfg._read_values() parses the file with str.splitlines(). A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.
Impact
The prompt value is the reachable input: it is set by --prompt, by the VIRTUALENV_PROMPT environment variable, or from the config file, and write() emits prompt before home. A crafted prompt can therefore set home in the generated pyvenv.cfg:
$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path
home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.
This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited VIRTUALENV_PROMPT. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.
Details
The boundary set is the one str.splitlines() recognizes, which is wider than \n: \r, \v, \f, the file, group and record separators, U+0085, U+2028 and U+2029 were all written through unchanged and all split the line when read back.
Patches
PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.
Workarounds
Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as --prompt or VIRTUALENV_PROMPT.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@20.39.1",
"upstream_fixed_in": "21.7.11"
},
"package": {
"ecosystem": "Homebrew",
"name": "conda-lock",
"purl": "pkg:brew/conda-lock"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@20.39.1",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "20.39.1"
}
]
},
"details": "### Summary\n\n`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.\n\n### Impact\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:\n\n```console\n$ virtualenv --prompt $\u0027x\"\\nhome = /attacker/path\\nprompt = \"z\u0027 venv\n$ grep \u0027^home\u0027 venv/pyvenv.cfg\nhome = /attacker/path\n```\n\n`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.\n\nThis requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.\n\n### Details\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than `\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.\n\n### Patches\n\n`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.\n\n### Workarounds\n\nDo not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.",
"id": "BREW-conda-lock-CVE-2026-102938",
"modified": "2026-10-04T19:25:06Z",
"published": "2026-10-04T19:25:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102938"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",
"upstream": [
"GHSA-9h9j-4vrj-gf7g",
"CVE-2026-102938",
"PYSEC-2026-4012"
]
}
BREW-PIPENV-CVE-2026-102938 (GHSA-9H9J-4VRJ-GF7G)
Vulnerability from osv_homebrew – Published: 2026-10-04 15:51 – Updated: 2026-10-04 15:51 – Source websiteSummary
pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while PyEnvCfg._read_values() parses the file with str.splitlines(). A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.
Impact
The prompt value is the reachable input: it is set by --prompt, by the VIRTUALENV_PROMPT environment variable, or from the config file, and write() emits prompt before home. A crafted prompt can therefore set home in the generated pyvenv.cfg:
$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path
home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.
This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited VIRTUALENV_PROMPT. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.
Details
The boundary set is the one str.splitlines() recognizes, which is wider than \n: \r, \v, \f, the file, group and record separators, U+0085, U+2028 and U+2029 were all written through unchanged and all split the line when read back.
Patches
PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.
Workarounds
Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as --prompt or VIRTUALENV_PROMPT.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.2",
"upstream_fixed_in": "21.7.11"
},
"package": {
"ecosystem": "Homebrew",
"name": "pipenv",
"purl": "pkg:brew/pipenv"
},
"ranges": [
{
"events": [
{
"introduced": "2018.11.26_4"
},
{
"fixed": "2026.8.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.2",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.2"
}
]
},
"details": "### Summary\n\n`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.\n\n### Impact\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:\n\n```console\n$ virtualenv --prompt $\u0027x\"\\nhome = /attacker/path\\nprompt = \"z\u0027 venv\n$ grep \u0027^home\u0027 venv/pyvenv.cfg\nhome = /attacker/path\n```\n\n`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.\n\nThis requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.\n\n### Details\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than `\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.\n\n### Patches\n\n`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.\n\n### Workarounds\n\nDo not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.",
"id": "BREW-pipenv-CVE-2026-102938",
"modified": "2026-10-04T15:51:22Z",
"published": "2026-10-04T15:51:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102938"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",
"upstream": [
"GHSA-9h9j-4vrj-gf7g",
"CVE-2026-102938",
"PYSEC-2026-4012"
]
}
BREW-TOX-CVE-2026-102938 (GHSA-9H9J-4VRJ-GF7G)
Vulnerability from osv_homebrew – Published: 2026-10-04 15:51 – Updated: 2026-10-05 09:09 – Source websiteSummary
pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while PyEnvCfg._read_values() parses the file with str.splitlines(). A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.
Impact
The prompt value is the reachable input: it is set by --prompt, by the VIRTUALENV_PROMPT environment variable, or from the config file, and write() emits prompt before home. A crafted prompt can therefore set home in the generated pyvenv.cfg:
$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path
home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.
This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited VIRTUALENV_PROMPT. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.
Details
The boundary set is the one str.splitlines() recognizes, which is wider than \n: \r, \v, \f, the file, group and record separators, U+0085, U+2028 and U+2029 were all written through unchanged and all split the line when read back.
Patches
PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.
Workarounds
Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as --prompt or VIRTUALENV_PROMPT.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.5",
"upstream_fixed_in": "21.7.11"
},
"package": {
"ecosystem": "Homebrew",
"name": "tox",
"purl": "pkg:brew/tox"
},
"ranges": [
{
"events": [
{
"introduced": "3.14.5_1"
},
{
"fixed": "4.62.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.5",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.5"
}
]
},
"details": "### Summary\n\n`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.\n\n### Impact\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:\n\n```console\n$ virtualenv --prompt $\u0027x\"\\nhome = /attacker/path\\nprompt = \"z\u0027 venv\n$ grep \u0027^home\u0027 venv/pyvenv.cfg\nhome = /attacker/path\n```\n\n`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.\n\nThis requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.\n\n### Details\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than `\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.\n\n### Patches\n\n`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.\n\n### Workarounds\n\nDo not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.",
"id": "BREW-tox-CVE-2026-102938",
"modified": "2026-10-05T09:09:04Z",
"published": "2026-10-04T15:51:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102938"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",
"upstream": [
"GHSA-9h9j-4vrj-gf7g",
"CVE-2026-102938",
"PYSEC-2026-4012"
]
}
BREW-VIRTUALFISH-CVE-202… (GHSA-9H9J-4VRJ-GF7G)
Vulnerability from osv_homebrew – Published: 2026-10-04 19:25 – Updated: 2026-10-04 21:33 – Source websiteSummary
pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while PyEnvCfg._read_values() parses the file with str.splitlines(). A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.
Impact
The prompt value is the reachable input: it is set by --prompt, by the VIRTUALENV_PROMPT environment variable, or from the config file, and write() emits prompt before home. A crafted prompt can therefore set home in the generated pyvenv.cfg:
$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path
home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.
This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited VIRTUALENV_PROMPT. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.
Details
The boundary set is the one str.splitlines() recognizes, which is wider than \n: \r, \v, \f, the file, group and record separators, U+0085, U+2028 and U+2029 were all written through unchanged and all split the line when read back.
Patches
PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.
Workarounds
Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as --prompt or VIRTUALENV_PROMPT.
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "virtualenv",
"resource_purl": "pkg:pypi/virtualenv@21.14.5",
"upstream_fixed_in": "21.7.11"
},
"package": {
"ecosystem": "Homebrew",
"name": "virtualfish",
"purl": "pkg:brew/virtualfish"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.5"
},
{
"fixed": "2.5.9_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/virtualenv@21.14.5",
"name": "virtualenv",
"resource": "virtualenv",
"strategy": "registry",
"subject_version": "21.14.5"
}
]
},
"details": "### Summary\n\n`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.\n\n### Impact\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:\n\n```console\n$ virtualenv --prompt $\u0027x\"\\nhome = /attacker/path\\nprompt = \"z\u0027 venv\n$ grep \u0027^home\u0027 venv/pyvenv.cfg\nhome = /attacker/path\n```\n\n`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.\n\nThis requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.\n\n### Details\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than `\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.\n\n### Patches\n\n`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.\n\n### Workarounds\n\nDo not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.",
"id": "BREW-virtualfish-CVE-2026-102938",
"modified": "2026-10-04T21:33:36Z",
"published": "2026-10-04T19:25:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102938"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
},
{
"type": "WEB",
"url": "https://pypi.org/project/virtualenv"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",
"upstream": [
"GHSA-9h9j-4vrj-gf7g",
"CVE-2026-102938",
"PYSEC-2026-4012"
]
}
CVE-2026-102938 (GCVE-0-2026-102938)
Vulnerability from cvelistv5 – Published: 2026-09-29 20:58 – Updated: 2026-09-30 19:53- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
| URL | Tags |
|---|---|
| https://github.com/pypa/virtualenv/security/advis… | x_refsource_CONFIRM |
| https://github.com/pypa/virtualenv/pull/3247 | x_refsource_MISC |
| https://github.com/pypa/virtualenv/commit/a30f995… | x_refsource_MISC |
| https://github.com/pypa/virtualenv/releases/tag/21.7.11 | x_refsource_MISC |
| Vendor | Product | Version | |
|---|---|---|---|
| pypa | virtualenv |
Affected:
< 21.7.11
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T19:53:10.688613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T19:53:20.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003c 21.7.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator\u0027s trust boundary; directly supplied prompt content primarily corrupts the operator\u0027s own environment. This issue is fixed in version 21.7.11."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T20:58:20.696Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"name": "https://github.com/pypa/virtualenv/pull/3247",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"name": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"name": "https://github.com/pypa/virtualenv/releases/tag/21.7.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
}
],
"source": {
"advisory": "GHSA-9h9j-4vrj-gf7g",
"discovery": "UNKNOWN"
},
"title": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102938",
"datePublished": "2026-09-29T20:58:20.696Z",
"dateReserved": "2026-09-29T20:24:43.340Z",
"dateUpdated": "2026-09-30T19:53:20.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
PYSEC-2026-4012
Vulnerability from pysec - Published: 2026-09-17 16:42 - Updated: 2026-09-30 16:13pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write()
wrote values verbatim, while PyEnvCfg._read_values() parses the file with
str.splitlines(). A value containing a line boundary therefore became
additional configuration lines, and because reading is last-wins, the injected
keys replaced any key written earlier in the file.
The prompt value is the reachable input: it is set by --prompt, by the
VIRTUALENV_PROMPT environment variable, or from the config file, and
write() emits prompt before home. A crafted prompt can therefore set
home in the generated pyvenv.cfg. home is what tooling reads to locate
the base interpreter, so a consumer that trusts it can be pointed elsewhere.
implementation, version_info, version, executable, command and
virtualenv are also written before prompt and can be replaced the same
way.
This requires the prompt to come from somewhere other than the person running
the command, for example a CI job templating a branch name into it, tooling
deriving an environment name from user-supplied data, or an inherited
VIRTUALENV_PROMPT.
The boundary set is the one str.splitlines() recognizes, which is wider than
\n: \r, \v, \f, the file, group and record separators, U+0085,
U+2028 and U+2029 were all written through unchanged and all split the
line when read back.
Fixed in 21.7.11: PyEnvCfg.write() now collapses those boundaries to spaces
as it serializes each line, so it cannot emit a structurally invalid file
regardless of what a caller places in content.
| Name | purl | virtualenv | pkg:pypi/virtualenv |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "virtualenv",
"purl": "pkg:pypi/virtualenv"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.7.11"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.8",
"0.8.1",
"0.8.2",
"0.8.3",
"0.8.4",
"0.9",
"0.9.1",
"0.9.2",
"1.0",
"1.1",
"1.10",
"1.10.1",
"1.11",
"1.11.1",
"1.11.2",
"1.11.3",
"1.11.4",
"1.11.5",
"1.11.6",
"1.2",
"1.3",
"1.3.1",
"1.3.2",
"1.3.3",
"1.3.4",
"1.4",
"1.4.1",
"1.4.2",
"1.4.3",
"1.4.4",
"1.4.5",
"1.4.6",
"1.4.7",
"1.4.8",
"1.4.9",
"1.4rc1",
"1.5",
"1.5.1",
"1.5.2",
"1.6",
"1.6.1",
"1.6.2",
"1.6.3",
"1.6.4",
"1.7",
"1.7.1",
"1.7.1.1",
"1.7.1.2",
"1.7.2",
"1.8",
"1.8.1",
"1.8.2",
"1.8.3",
"1.8.4",
"1.9",
"1.9.1",
"12.0",
"12.0.1",
"12.0.2",
"12.0.4",
"12.0.5",
"12.0.6",
"12.0.7",
"12.1.0",
"12.1.1",
"13.0.0",
"13.0.1",
"13.0.2",
"13.0.3",
"13.1.0",
"13.1.1",
"13.1.2",
"14.0.0",
"14.0.1",
"14.0.2",
"14.0.3",
"14.0.4",
"14.0.5",
"14.0.6",
"15.0.0",
"15.0.1",
"15.0.2",
"15.0.3",
"15.1.0",
"15.2.0",
"16.0.0",
"16.1.0",
"16.2.0",
"16.3.0",
"16.3.1.dev0",
"16.4.0",
"16.4.1",
"16.4.3",
"16.4.4.dev0",
"16.5.0",
"16.6.0",
"16.6.1",
"16.6.2",
"16.7.0",
"16.7.1",
"16.7.10",
"16.7.11",
"16.7.12",
"16.7.2",
"16.7.3",
"16.7.4",
"16.7.5",
"16.7.6",
"16.7.7",
"16.7.8",
"16.7.9",
"20.0.0",
"20.0.0b1",
"20.0.0b2",
"20.0.1",
"20.0.10",
"20.0.11",
"20.0.12",
"20.0.13",
"20.0.14",
"20.0.15",
"20.0.16",
"20.0.17",
"20.0.18",
"20.0.19",
"20.0.2",
"20.0.20",
"20.0.21",
"20.0.22",
"20.0.23",
"20.0.24",
"20.0.25",
"20.0.26",
"20.0.27",
"20.0.28",
"20.0.29",
"20.0.3",
"20.0.30",
"20.0.31",
"20.0.32",
"20.0.33",
"20.0.34",
"20.0.35",
"20.0.4",
"20.0.5",
"20.0.6",
"20.0.7",
"20.0.8",
"20.0.9",
"20.1.0",
"20.10.0",
"20.11.0",
"20.11.1",
"20.11.2",
"20.12.0",
"20.12.1",
"20.13.0",
"20.13.1",
"20.13.2",
"20.13.3",
"20.13.4",
"20.14.0",
"20.14.1",
"20.15.0",
"20.15.1",
"20.16.0",
"20.16.1",
"20.16.2",
"20.16.3",
"20.16.4",
"20.16.5",
"20.16.6",
"20.16.7",
"20.17.0",
"20.17.1",
"20.18.0",
"20.19.0",
"20.2.0",
"20.2.1",
"20.2.2",
"20.20.0",
"20.21.0",
"20.21.1",
"20.22.0",
"20.23.0",
"20.23.1",
"20.24.0",
"20.24.1",
"20.24.2",
"20.24.3",
"20.24.4",
"20.24.5",
"20.24.6",
"20.24.7",
"20.25.0",
"20.25.1",
"20.25.2",
"20.25.3",
"20.26.0",
"20.26.1",
"20.26.2",
"20.26.3",
"20.26.4",
"20.26.5",
"20.26.6",
"20.27.0",
"20.27.1",
"20.28.0",
"20.28.1",
"20.29.0",
"20.29.1",
"20.29.2",
"20.29.3",
"20.3.0",
"20.3.1",
"20.30.0",
"20.31.0",
"20.31.1",
"20.31.2",
"20.32.0",
"20.33.0",
"20.33.1",
"20.34.0",
"20.35.0",
"20.35.1",
"20.35.2",
"20.35.3",
"20.35.4",
"20.36.0",
"20.36.1",
"20.38.0",
"20.39.0",
"20.39.1",
"20.4.0",
"20.4.1",
"20.4.2",
"20.4.3",
"20.4.4",
"20.4.5",
"20.4.6",
"20.4.7",
"20.5.0",
"20.6.0",
"20.7.0",
"20.7.1",
"20.7.2",
"20.8.0",
"20.8.1",
"20.9.0",
"21.0.0",
"21.1.0",
"21.2.0",
"21.2.1",
"21.2.2",
"21.2.3",
"21.2.4",
"21.3.0",
"21.3.1",
"21.3.2",
"21.3.3",
"21.4.0",
"21.4.1",
"21.4.2",
"21.4.3",
"21.5.0",
"21.5.1",
"21.5.2",
"21.6.0",
"21.6.1",
"21.7.0",
"21.7.1",
"21.7.10",
"21.7.2",
"21.7.3",
"21.7.4",
"21.7.5",
"21.7.6",
"21.7.7",
"21.7.8",
"21.7.9"
]
}
],
"aliases": [
"CVE-2026-102938",
"GHSA-9h9j-4vrj-gf7g"
],
"credits": [
{
"name": "Bern\u00e1t G\u00e1bor",
"type": "FINDER"
}
],
"details": "`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()`\nwrote values verbatim, while `PyEnvCfg._read_values()` parses the file with\n`str.splitlines()`. A value containing a line boundary therefore became\nadditional configuration lines, and because reading is last-wins, the injected\nkeys replaced any key written earlier in the file.\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the\n`VIRTUALENV_PROMPT` environment variable, or from the config file, and\n`write()` emits `prompt` before `home`. A crafted prompt can therefore set\n`home` in the generated `pyvenv.cfg`. `home` is what tooling reads to locate\nthe base interpreter, so a consumer that trusts it can be pointed elsewhere.\n`implementation`, `version_info`, `version`, `executable`, `command` and\n`virtualenv` are also written before `prompt` and can be replaced the same\nway.\n\nThis requires the prompt to come from somewhere other than the person running\nthe command, for example a CI job templating a branch name into it, tooling\nderiving an environment name from user-supplied data, or an inherited\n`VIRTUALENV_PROMPT`.\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than\n`\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`,\n`U+2028` and `U+2029` were all written through unchanged and all split the\nline when read back.\n\nFixed in 21.7.11: `PyEnvCfg.write()` now collapses those boundaries to spaces\nas it serializes each line, so it cannot emit a structurally invalid file\nregardless of what a caller places in `content`.\n",
"id": "PYSEC-2026-4012",
"modified": "2026-09-30T16:13:20.447448Z",
"published": "2026-09-17T16:42:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/pull/3247"
},
{
"type": "FIX",
"url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
},
{
"type": "WEB",
"url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
},
{
"type": "PACKAGE",
"url": "https://github.com/pypa/virtualenv"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/virtualenv"
}
],
"summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.