CVE catalog

CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_val

[CVE catalog]

Severity
High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-virtualenvsid21.5.1+ds-1vulnerable
Debianpython-virtualenvforky21.5.1+ds-1vulnerable
Debianpython-virtualenvtrixie20.31.2+ds-1+deb13u1vulnerable
Debianpython-virtualenvbookworm20.17.1+ds-1vulnerable
PyPIvirtualenvNot reported21.7.11fixed
PyPIvirtualenvNot reported21.7.11fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-virtualenvsourcesid(unfixed)not yet assignedNot reported[1149650]
Debianpython-virtualenvsourceforky(unfixed)not yet assignedNot reported[1149650]
Debianpython-virtualenvsourcetrixie(unfixed)not yet assignedNot reported[1149650]
Debianpython-virtualenvsourcebookworm(unfixed)not yet assignedNot reported[1149650]
PyPIvirtualenvPyPINot reported21.7.11Not reportedPYSEC-2026-4012Not reported
PyPIvirtualenvPyPINot reported21.7.11Not reportedGHSA-9H9J-4VRJ-GF7GNot reported

[Debian bug #1149650]

Notes

[trixie] python-virtualenv: Minor issue [bookworm] python-virtualenv: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-virtualenv]Affected

    Source package: [python-virtualenv]

    Details (2)

    • 20.17.1+ds-1 · all · bookworm

      Affected

      nvd · python-virtualenv · debian · bookworm; nvd · python-virtualenv · debian · 12

    • 20.17.1+ds-1 · all · bookworm

      Affected

      nvd · python-virtualenv · debian · bookworm; nvd · python-virtualenv · debian · 12

  • [virtualenv]Affected

    Source package: [python-virtualenv]

    Details (2)

    • 20.17.1+ds-1 · all · bookworm

      Affected

      nvd · python-virtualenv · debian · bookworm; nvd · python-virtualenv · debian · 12

    • 20.17.1+ds-1 · all · bookworm

      Affected

      nvd · python-virtualenv · debian · bookworm; nvd · python-virtualenv · debian · 12

[Debian 13 (Trixie)]

  • [python3-virtualenv]Affected

    Source package: [python-virtualenv]

    Details (2)

    • 20.31.2+ds-1+deb13u1 · all · trixie

      Affected

      nvd · python-virtualenv · debian · 13

    • 20.31.2+ds-1+deb13u1 · all · trixie

      Affected

      nvd · python-virtualenv · debian · 13

  • [virtualenv]Affected

    Source package: [python-virtualenv]

    Details (2)

    • 20.31.2+ds-1+deb13u1 · all · trixie

      Affected

      nvd · python-virtualenv · debian · 13

    • 20.31.2+ds-1+deb13u1 · all · trixie

      Affected

      nvd · python-virtualenv · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]