Vulnerability-Lookup

PYSEC-2026-4012

Vulnerability from pysec - Published: 2026-09-17 16:42 - Updated: 2026-09-30 16:13

Details

pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while PyEnvCfg._read_values() parses the file with str.splitlines(). A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.

The prompt value is the reachable input: it is set by --prompt, by the VIRTUALENV_PROMPT environment variable, or from the config file, and write() emits prompt before home. A crafted prompt can therefore set home in the generated pyvenv.cfg. home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.

The boundary set is the one str.splitlines() recognizes, which is wider than \n: \r, \v, \f, the file, group and record separators, U+0085, U+2028 and U+2029 were all written through unchanged and all split the line when read back.

Fixed in 21.7.11: PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.

Impacted products

Name	purl
virtualenv	pkg:pypi/virtualenv

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "virtualenv",
        "purl": "pkg:pypi/virtualenv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "21.7.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.9",
        "0.9.1",
        "0.9.2",
        "1.0",
        "1.1",
        "1.10",
        "1.10.1",
        "1.11",
        "1.11.1",
        "1.11.2",
        "1.11.3",
        "1.11.4",
        "1.11.5",
        "1.11.6",
        "1.2",
        "1.3",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.4",
        "1.4.1",
        "1.4.2",
        "1.4.3",
        "1.4.4",
        "1.4.5",
        "1.4.6",
        "1.4.7",
        "1.4.8",
        "1.4.9",
        "1.4rc1",
        "1.5",
        "1.5.1",
        "1.5.2",
        "1.6",
        "1.6.1",
        "1.6.2",
        "1.6.3",
        "1.6.4",
        "1.7",
        "1.7.1",
        "1.7.1.1",
        "1.7.1.2",
        "1.7.2",
        "1.8",
        "1.8.1",
        "1.8.2",
        "1.8.3",
        "1.8.4",
        "1.9",
        "1.9.1",
        "12.0",
        "12.0.1",
        "12.0.2",
        "12.0.4",
        "12.0.5",
        "12.0.6",
        "12.0.7",
        "12.1.0",
        "12.1.1",
        "13.0.0",
        "13.0.1",
        "13.0.2",
        "13.0.3",
        "13.1.0",
        "13.1.1",
        "13.1.2",
        "14.0.0",
        "14.0.1",
        "14.0.2",
        "14.0.3",
        "14.0.4",
        "14.0.5",
        "14.0.6",
        "15.0.0",
        "15.0.1",
        "15.0.2",
        "15.0.3",
        "15.1.0",
        "15.2.0",
        "16.0.0",
        "16.1.0",
        "16.2.0",
        "16.3.0",
        "16.3.1.dev0",
        "16.4.0",
        "16.4.1",
        "16.4.3",
        "16.4.4.dev0",
        "16.5.0",
        "16.6.0",
        "16.6.1",
        "16.6.2",
        "16.7.0",
        "16.7.1",
        "16.7.10",
        "16.7.11",
        "16.7.12",
        "16.7.2",
        "16.7.3",
        "16.7.4",
        "16.7.5",
        "16.7.6",
        "16.7.7",
        "16.7.8",
        "16.7.9",
        "20.0.0",
        "20.0.0b1",
        "20.0.0b2",
        "20.0.1",
        "20.0.10",
        "20.0.11",
        "20.0.12",
        "20.0.13",
        "20.0.14",
        "20.0.15",
        "20.0.16",
        "20.0.17",
        "20.0.18",
        "20.0.19",
        "20.0.2",
        "20.0.20",
        "20.0.21",
        "20.0.22",
        "20.0.23",
        "20.0.24",
        "20.0.25",
        "20.0.26",
        "20.0.27",
        "20.0.28",
        "20.0.29",
        "20.0.3",
        "20.0.30",
        "20.0.31",
        "20.0.32",
        "20.0.33",
        "20.0.34",
        "20.0.35",
        "20.0.4",
        "20.0.5",
        "20.0.6",
        "20.0.7",
        "20.0.8",
        "20.0.9",
        "20.1.0",
        "20.10.0",
        "20.11.0",
        "20.11.1",
        "20.11.2",
        "20.12.0",
        "20.12.1",
        "20.13.0",
        "20.13.1",
        "20.13.2",
        "20.13.3",
        "20.13.4",
        "20.14.0",
        "20.14.1",
        "20.15.0",
        "20.15.1",
        "20.16.0",
        "20.16.1",
        "20.16.2",
        "20.16.3",
        "20.16.4",
        "20.16.5",
        "20.16.6",
        "20.16.7",
        "20.17.0",
        "20.17.1",
        "20.18.0",
        "20.19.0",
        "20.2.0",
        "20.2.1",
        "20.2.2",
        "20.20.0",
        "20.21.0",
        "20.21.1",
        "20.22.0",
        "20.23.0",
        "20.23.1",
        "20.24.0",
        "20.24.1",
        "20.24.2",
        "20.24.3",
        "20.24.4",
        "20.24.5",
        "20.24.6",
        "20.24.7",
        "20.25.0",
        "20.25.1",
        "20.25.2",
        "20.25.3",
        "20.26.0",
        "20.26.1",
        "20.26.2",
        "20.26.3",
        "20.26.4",
        "20.26.5",
        "20.26.6",
        "20.27.0",
        "20.27.1",
        "20.28.0",
        "20.28.1",
        "20.29.0",
        "20.29.1",
        "20.29.2",
        "20.29.3",
        "20.3.0",
        "20.3.1",
        "20.30.0",
        "20.31.0",
        "20.31.1",
        "20.31.2",
        "20.32.0",
        "20.33.0",
        "20.33.1",
        "20.34.0",
        "20.35.0",
        "20.35.1",
        "20.35.2",
        "20.35.3",
        "20.35.4",
        "20.36.0",
        "20.36.1",
        "20.38.0",
        "20.39.0",
        "20.39.1",
        "20.4.0",
        "20.4.1",
        "20.4.2",
        "20.4.3",
        "20.4.4",
        "20.4.5",
        "20.4.6",
        "20.4.7",
        "20.5.0",
        "20.6.0",
        "20.7.0",
        "20.7.1",
        "20.7.2",
        "20.8.0",
        "20.8.1",
        "20.9.0",
        "21.0.0",
        "21.1.0",
        "21.2.0",
        "21.2.1",
        "21.2.2",
        "21.2.3",
        "21.2.4",
        "21.3.0",
        "21.3.1",
        "21.3.2",
        "21.3.3",
        "21.4.0",
        "21.4.1",
        "21.4.2",
        "21.4.3",
        "21.5.0",
        "21.5.1",
        "21.5.2",
        "21.6.0",
        "21.6.1",
        "21.7.0",
        "21.7.1",
        "21.7.10",
        "21.7.2",
        "21.7.3",
        "21.7.4",
        "21.7.5",
        "21.7.6",
        "21.7.7",
        "21.7.8",
        "21.7.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102938",
    "GHSA-9h9j-4vrj-gf7g"
  ],
  "credits": [
    {
      "name": "Bern\u00e1t G\u00e1bor",
      "type": "FINDER"
    }
  ],
  "details": "`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()`\nwrote values verbatim, while `PyEnvCfg._read_values()` parses the file with\n`str.splitlines()`. A value containing a line boundary therefore became\nadditional configuration lines, and because reading is last-wins, the injected\nkeys replaced any key written earlier in the file.\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the\n`VIRTUALENV_PROMPT` environment variable, or from the config file, and\n`write()` emits `prompt` before `home`. A crafted prompt can therefore set\n`home` in the generated `pyvenv.cfg`. `home` is what tooling reads to locate\nthe base interpreter, so a consumer that trusts it can be pointed elsewhere.\n`implementation`, `version_info`, `version`, `executable`, `command` and\n`virtualenv` are also written before `prompt` and can be replaced the same\nway.\n\nThis requires the prompt to come from somewhere other than the person running\nthe command, for example a CI job templating a branch name into it, tooling\nderiving an environment name from user-supplied data, or an inherited\n`VIRTUALENV_PROMPT`.\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than\n`\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`,\n`U+2028` and `U+2029` were all written through unchanged and all split the\nline when read back.\n\nFixed in 21.7.11: `PyEnvCfg.write()` now collapses those boundaries to spaces\nas it serializes each line, so it cannot emit a structurally invalid file\nregardless of what a caller places in `content`.\n",
  "id": "PYSEC-2026-4012",
  "modified": "2026-09-30T16:13:20.447448Z",
  "published": "2026-09-17T16:42:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3247"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/virtualenv"
    }
  ],
  "summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection"
}

BREW-CLOUDISCOVERY-CVE-2… (PYSEC-2026-4012)

Vulnerability from osv_homebrew – Published: 2026-09-30 21:05 – Updated: 2026-09-30 21:05 – Source website

Summary

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Details

References

URL

Type

	https://github.com/pypa/virtualenv/security/advis…	WEB
	https://github.com/pypa/virtualenv/pull/3247	WEB
	https://github.com/pypa/virtualenv/commit/a30f995…	FIX
	https://github.com/pypa/virtualenv/releases/tag/21.7.11	WEB
	https://github.com/pypa/virtualenv	PACKAGE
	https://pypi.org/project/virtualenv	PACKAGE

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "virtualenv",
        "resource_purl": "pkg:pypi/virtualenv@20.31.2",
        "upstream_fixed_in": "21.7.11"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "cloudiscovery",
        "purl": "pkg:brew/cloudiscovery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.4_4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/virtualenv@20.31.2",
        "name": "virtualenv",
        "resource": "virtualenv",
        "strategy": "registry",
        "subject_version": "20.31.2"
      }
    ]
  },
  "details": "`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()`\nwrote values verbatim, while `PyEnvCfg._read_values()` parses the file with\n`str.splitlines()`. A value containing a line boundary therefore became\nadditional configuration lines, and because reading is last-wins, the injected\nkeys replaced any key written earlier in the file.\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the\n`VIRTUALENV_PROMPT` environment variable, or from the config file, and\n`write()` emits `prompt` before `home`. A crafted prompt can therefore set\n`home` in the generated `pyvenv.cfg`. `home` is what tooling reads to locate\nthe base interpreter, so a consumer that trusts it can be pointed elsewhere.\n`implementation`, `version_info`, `version`, `executable`, `command` and\n`virtualenv` are also written before `prompt` and can be replaced the same\nway.\n\nThis requires the prompt to come from somewhere other than the person running\nthe command, for example a CI job templating a branch name into it, tooling\nderiving an environment name from user-supplied data, or an inherited\n`VIRTUALENV_PROMPT`.\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than\n`\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`,\n`U+2028` and `U+2029` were all written through unchanged and all split the\nline when read back.\n\nFixed in 21.7.11: `PyEnvCfg.write()` now collapses those boundaries to spaces\nas it serializes each line, so it cannot emit a structurally invalid file\nregardless of what a caller places in `content`.\n",
  "id": "BREW-cloudiscovery-CVE-2026-102938",
  "modified": "2026-09-30T21:05:15Z",
  "published": "2026-09-30T21:05:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3247"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/virtualenv"
    }
  ],
  "schema_version": "1.7.3",
  "summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",
  "upstream": [
    "PYSEC-2026-4012",
    "CVE-2026-102938",
    "GHSA-9h9j-4vrj-gf7g"
  ]
}

CVE-2026-102938 (GCVE-0-2026-102938)

Vulnerability from cvelistv5 – Published: 2026-09-29 20:58 – Updated: 2026-09-30 19:53

Title

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Summary

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.

Severity

5.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:53 UTC

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/pypa/virtualenv/security/advis…	x_refsource_CONFIRM
https://github.com/pypa/virtualenv/pull/3247	x_refsource_MISC
https://github.com/pypa/virtualenv/commit/a30f995…	x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.7.11	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pypa	virtualenv	Affected: < 21.7.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102938",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:53:10.688613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:53:20.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "virtualenv",
          "vendor": "pypa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 21.7.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator\u0027s trust boundary; directly supplied prompt content primarily corrupts the operator\u0027s own environment. This issue is fixed in version 21.7.11."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T20:58:20.696Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
        },
        {
          "name": "https://github.com/pypa/virtualenv/pull/3247",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/pull/3247"
        },
        {
          "name": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
        },
        {
          "name": "https://github.com/pypa/virtualenv/releases/tag/21.7.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
        }
      ],
      "source": {
        "advisory": "GHSA-9h9j-4vrj-gf7g",
        "discovery": "UNKNOWN"
      },
      "title": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102938",
    "datePublished": "2026-09-29T20:58:20.696Z",
    "dateReserved": "2026-09-29T20:24:43.340Z",
    "dateUpdated": "2026-09-30T19:53:20.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-9H9J-4VRJ-GF7G

Vulnerability from github – Published: 2026-09-30 23:53 – Updated: 2026-09-30 23:53

Summary

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Details

Summary

Impact

$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path

home is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. implementation, version_info, version, executable, command and virtualenv are also written before prompt and can be replaced the same way.

This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited VIRTUALENV_PROMPT. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.

Details

Patches

PyEnvCfg.write() now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in content.

Workarounds

Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as --prompt or VIRTUALENV_PROMPT.

Severity

5.8 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 21.7.10"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "virtualenv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "21.7.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-30T23:53:58Z",
    "nvd_published_at": "2026-09-29T21:17:19Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.\n\n### Impact\n\nThe `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:\n\n```console\n$ virtualenv --prompt $\u0027x\"\\nhome = /attacker/path\\nprompt = \"z\u0027 venv\n$ grep \u0027^home\u0027 venv/pyvenv.cfg\nhome = /attacker/path\n```\n\n`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.\n\nThis requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.\n\n### Details\n\nThe boundary set is the one `str.splitlines()` recognizes, which is wider than `\\n`: `\\r`, `\\v`, `\\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.\n\n### Patches\n\n`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.\n\n### Workarounds\n\nDo not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.",
  "id": "GHSA-9h9j-4vrj-gf7g",
  "modified": "2026-09-30T23:53:58Z",
  "published": "2026-09-30T23:53:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102938"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/pull/3247"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/virtualenv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/virtualenv/releases/tag/21.7.11"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/virtualenv"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

PYSEC-2026-4012

BREW-CLOUDISCOVERY-CVE-2… (PYSEC-2026-4012)

CVE-2026-102938 (GCVE-0-2026-102938)

GHSA-9H9J-4VRJ-GF7G

Summary

Impact

Details

Patches

Workarounds

Tags

Sightings

Nomenclature

Related by attack behaviour