Path Injection Vulnerability in Virtualenv by PyPa

CVE-2026-113715

What is CVE-2026-113715?

A vulnerability exists in virtualenv, a tool for creating isolated Python environments, prior to version 21.14.9. The stdlib venv creator improperly processes the 'pyvenv.cfg' file, allowing an untrusted caller to inject line-boundary characters such as U+2028, which can alter configuration keys. This results in compromising environment isolation by enabling 'include-system-site-packages' and altering the home directory, thus affecting the standard-library files loaded by the interpreter. This issue poses a significant risk as it undermines the intended functionality of virtual environments. The vulnerability has been addressed in the latest release, 21.14.9.

References