Remote Code Execution Vulnerability in Virtualenv by PyPa

CVE-2026-102938

What is CVE-2026-102938?

A security vulnerability in Virtualenv allows attackers to manipulate prompt values and configuration inputs. Specifically, the function PyEnvCfg.write() improperly handles input, enabling an attacker to insert recognized line boundaries and additional keys. This can lead to the selection of a malicious interpreter or corrupt environment metadata. The threat primarily arises from untrusted prompt input sources, which can compromise the operator's environment. The issue has been rectified in Virtualenv version 21.7.11.

References