CVE-2026-113715

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.

• CWE-93

• https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a
• https://github.com/pypa/virtualenv/pull/3426
• https://github.com/pypa/virtualenv/releases/tag/21.14.9
• https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11371The BetterDocs WordPress plugin before 4.5.5 does not sanit…6.1
• CVE-2026-113710ApostropheCMS is an open-source Node.js content management s…5.9
• CVE-2026-113711ApostropheCMS is an open-source Node.js content management s…7.5
• CVE-2026-113712Cachet is an open-source status page system. Versions 2.4.1 …4.8
• CVE-2026-113713virtualenv is a tool for creating isolated virtual python en…4.4
• CVE-2026-113714virtualenv is a tool for creating isolated virtual python en…2.3
• CVE-2026-113716virtualenv is a tool for creating isolated virtual python en…4.5
• CVE-2026-113717virtualenv is a tool for creating isolated virtual python en…2.3
• CVE-2026-113718virtualenv is a tool for creating isolated virtual python en…7.1
• CVE-2026-113719virtualenv is a tool for creating isolated virtual python en…4.5
• CVE-2026-11372IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vuln…5.4
• CVE-2026-113720virtualenv is a tool for creating isolated virtual python en…4.4