CVE-2026-113715 (GCVE-0-2026-113715)
Vulnerability from cvelistv5
Published
2026-10-20 19:42
Modified
2026-10-23 02:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Summary
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| pypa | virtualenv |
Version: < 21.14.9 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113715",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T02:01:27.346462Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T02:01:48.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "virtualenv",
"vendor": "pypa",
"versions": [
{
"status": "affected",
"version": "\u003c 21.14.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv\u0027s selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:42:55.011Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf"
},
{
"name": "https://github.com/pypa/virtualenv/pull/3426",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/pull/3426"
},
{
"name": "https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a"
},
{
"name": "https://github.com/pypa/virtualenv/releases/tag/21.14.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9"
}
],
"source": {
"advisory": "GHSA-qmx5-4p3x-wvqf",
"discovery": "UNKNOWN"
},
"title": "virtualenv: Venv configuration readback can reinterpret path boundaries"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113715",
"datePublished": "2026-10-20T19:42:55.011Z",
"dateReserved": "2026-10-20T16:03:14.862Z",
"dateUpdated": "2026-10-23T02:01:48.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-113715\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-23T02:01:27.346462Z\"}}}], \"references\": [{\"url\": \"https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-23T02:01:43.826Z\"}}], \"cna\": {\"title\": \"virtualenv: Venv configuration readback can reinterpret path boundaries\", \"source\": {\"advisory\": \"GHSA-qmx5-4p3x-wvqf\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"pypa\", \"product\": \"virtualenv\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 21.14.9\"}]}], \"references\": [{\"url\": \"https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf\", \"name\": \"https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/pypa/virtualenv/pull/3426\", \"name\": \"https://github.com/pypa/virtualenv/pull/3426\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a\", \"name\": \"https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/pypa/virtualenv/releases/tag/21.14.9\", \"name\": \"https://github.com/pypa/virtualenv/releases/tag/21.14.9\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv\u0027s selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-93\", \"description\": \"CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-20T19:42:55.011Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-113715\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-23T02:01:48.925Z\", \"dateReserved\": \"2026-10-20T16:03:14.862Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-10-20T19:42:55.011Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…