https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 15:22:01 +0000 https://db.gcve.eu/vuln/bit-virtualenv-2026-113715 <p><strong>Affected:</strong> Bitnami: virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv&#39;s selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.</p> <p><strong>Affected:</strong> Bitnami: virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv&#39;s selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.</p> https://db.gcve.eu/vuln/bit-virtualenv-2026-113715 https://db.gcve.eu/vuln/cve-2026-113715 <p><strong>Affected:</strong> pypa virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv&#39;s selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.</p> <p><strong>Affected:</strong> pypa virtualenv</p> <p>virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv&#39;s selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.</p> https://db.gcve.eu/vuln/cve-2026-113715 https://db.gcve.eu/vuln/ghsa-qmx5-4p3x-wvqf <p><strong>Affected:</strong> PyPI: virtualenv</p> <p>## Summary</p> <p>The venv creator reads the standard library&#39;s generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv&#39;s configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization.</p> <p>Anthropic&#39;s OSS Scanner reported this as `ANT-2026-6ZQHJ6VI` in `virtualenv-20261015-005`, received on 15 October 2026.</p> <p>## Affected area</p> <p>Configuration readback by the stdlib venv creator.</p> <p>## Attacker-controlled input</p> <p>An untrusted caller must influence the destination pathname passed to the venv creator. That pathname must contain a character that Python treats as a line boundary. The builtin creator follows a different configuration-writing path.</p> <p>## Affected code</p> <p>The relevant 21.14.8 source is in [venv readback](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/via_global_ref/venv.py), [configuration parser](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/pyenv_cfg.py).</p> <p>## Mechanism</p> <p>With `--creator venv`, virtualenv asks the standard library to create an environment, reads its `pyvenv.cfg` with `str.splitlines()`, and merges the parsed keys over virtualenv&#39;s chosen settings. CPython writes the destination into a `command =` value without escaping every character that `splitlines()` recognizes as a line boundary. A destination containing U+2028, for example, can therefore supply new `ho…</p> <p><strong>Affected:</strong> PyPI: virtualenv</p> <p>## Summary</p> <p>The venv creator reads the standard library&#39;s generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv&#39;s configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization.</p> <p>Anthropic&#39;s OSS Scanner reported this as `ANT-2026-6ZQHJ6VI` in `virtualenv-20261015-005`, received on 15 October 2026.</p> <p>## Affected area</p> <p>Configuration readback by the stdlib venv creator.</p> <p>## Attacker-controlled input</p> <p>An untrusted caller must influence the destination pathname passed to the venv creator. That pathname must contain a character that Python treats as a line boundary. The builtin creator follows a different configuration-writing path.</p> <p>## Affected code</p> <p>The relevant 21.14.8 source is in [venv readback](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/via_global_ref/venv.py), [configuration parser](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/pyenv_cfg.py).</p> <p>## Mechanism</p> <p>With `--creator venv`, virtualenv asks the standard library to create an environment, reads its `pyvenv.cfg` with `str.splitlines()`, and merges the parsed keys over virtualenv&#39;s chosen settings. CPython writes the destination into a `command =` value without escaping every character that `splitlines()` recognizes as a line boundary. A destination containing U+2028, for example, can therefore supply new `ho…</p> https://db.gcve.eu/vuln/ghsa-qmx5-4p3x-wvqf