CVE-2026-102938 in virtualenv
Summary
by MITRE • 09/30/2026
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified within virtualenv versions prior to 21.7.11 stems from a critical flaw in how configuration data is serialized and deserialized, specifically involving the PyEnvCfg class methods write() and _read_values(). Virtualenv relies on the pyvenv.cfg file to store essential metadata about the isolated Python environment, including paths to base interpreters and custom prompt strings. The root cause lies in the lack of input validation during the writing process combined with a permissive parsing strategy during reading. When PyEnvCfg.write() executes, it writes user-supplied prompt values directly into the configuration file without sanitizing or escaping special characters that hold structural significance within the line-oriented format. This behavior assumes that all inputs are safe and well-formed, which is an incorrect assumption when dealing with external or untrusted data sources such as command-line arguments like --prompt or environment variables like VIRTUALENV_PROMPT.
The parsing logic in PyEnvCfg._read_values() exacerbates this issue by utilizing str.splitlines() to break the configuration file into individual lines and subsequently processing key-value pairs. Crucially, when duplicate keys are encountered during this parsing phase, the method accepts only the last value for any given key rather than raising an error or merging values safely. This design choice creates a predictable overwrite mechanism that can be exploited by an attacker who controls the input used to generate the prompt string. By injecting recognized line boundary characters into the prompt value, an adversary can effectively terminate the intended prompt entry and append new configuration directives on subsequent lines within the same file structure.
This capability allows for significant environment manipulation with severe operational impacts. An attacker capable of influencing the prompt input can insert additional keys such as home, which dictates the path to the base Python interpreter used by the virtual environment. If an application or script relies on this virtualenv and reads its configuration after it has been tampered with, it may inadvertently load a corrupted metadata state or point to an attacker-selected base interpreter. This scenario effectively breaks the isolation guarantees that virtual environments are designed to provide, potentially leading to code execution vulnerabilities if the selected base interpreter contains malicious modifications or is located in a directory controlled by the attacker. The security impact is contingent upon prompt input originating from outside the operator's trust boundary; direct manipulation of prompt content primarily results in local environment corruption for the immediate user rather than broader system compromise unless that corrupted state is consumed by other processes with elevated privileges or different trust levels.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-20 Improper Input Validation due to the failure to sanitize special characters in user-supplied data before processing it as part of a structured configuration format. In terms of attack vectors, this relates to ATT&CK technique T1574 Hijack Execution Flow via DLL Search Order Hijacking or similar path manipulation tactics where an attacker alters execution context by modifying environment configurations. The exploitation requires the ability to inject content into the prompt parameter during virtualenv creation, which could occur through automated build scripts, CI/CD pipelines, or shared development environments if input validation is not enforced at those stages.
Mitigation for this vulnerability involves upgrading to version 21.7.11 of virtualenv where these parsing and writing behaviors have been corrected to prevent unauthorized key injection. For organizations unable to immediately upgrade, implementing strict input sanitization on any data passed to the --prompt flag or VIRTUALENV_PROMPT environment variable is recommended. This includes filtering out newline characters and other control codes that could disrupt the line-oriented structure of pyvenv.cfg. Additionally, adopting a defense-in-depth strategy by validating configuration files before consumption in critical applications can help detect anomalies such as unexpected key-value pairs or duplicate entries that deviate from expected environmental metadata structures.