CVE-2026-102938

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102938

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.7.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

The vulnerability in virtualenv versions before 21.7.11 allows an attacker to manipulate the prompt configuration by inserting line breaks and additional keys into the pyvenv.cfg file. This can cause the environment to use a malicious base interpreter or corrupt metadata.

Detection Guidance

This vulnerability can be detected by checking the version of virtualenv installed on your system. Run 'pip show virtualenv' or 'virtualenv --version' to verify if the version is below 21.7.11. If so, the system is vulnerable.

Impact Analysis

If an attacker influences the prompt input, they could trick the system into using an unauthorized Python interpreter or corrupt environment settings. This primarily affects users who rely on virtualenv for isolated Python environments.

Compliance Impact

This vulnerability primarily allows an attacker to manipulate environment metadata or base interpreter selection through crafted prompt input. While it could lead to unauthorized environment changes, there is no direct evidence in the provided context that this vulnerability specifically impacts compliance with GDPR, HIPAA, or similar standards.

Mitigation Strategies

Upgrade virtualenv to version 21.7.11 or later to address the prompt injection vulnerability in PyEnvCfg.write() and PyEnvCfg._read_values().

Hi! I’m here to help you understand CVE-2026-102938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70