Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-113715virtualenv: Venv configuration readback can reinterpret path boundaries

Low 2.0

In plain English

A low-severity security flaw in virtualenv from pypa. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.0Low

Exploit odds (30 days)0.2%top 84.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113715
Debian:13	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113715
Debian:14	python-virtualenv	no fix listed	DEBIAN-CVE-2026-113715
PyPI	virtualenv	21.14.9	GHSA-qmx5-4p3x-wvqf
Ubuntu:26.04:LTS	python-virtualenv	no fix listed	UBUNTU-CVE-2026-113715
Ubuntu:26.10	python-virtualenv	no fix listed	UBUNTU-CVE-2026-113715

Affected products (as reported)

Vendor	Product	Versions
pypa	virtualenv	< 21.14.9

Weakness: CWE-93 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf x_refsource_CONFIRM
https://github.com/pypa/virtualenv/pull/3426 x_refsource_MISC
https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a x_refsource_MISC
https://github.com/pypa/virtualenv/releases/tag/21.14.9 x_refsource_MISC