CVE-2026-113715

Received Received - Intake

Path Traversal in virtualenv Python Environment

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113715

EUVD

EUVD-2026-105301

Affected Vendors & Products

Vendor	Product	Version / Range
pypa	virtualenv	< 21.14.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability affects the virtualenv tool, which creates isolated Python environments. In versions before 21.14.9, the venv creator reads a configuration file using splitlines() and merges its settings over virtualenv's configuration. Attackers can exploit this by including line-boundary characters (like U+2028) in the destination path, which are interpreted as new configuration lines. This allows injection of malicious settings such as home directory paths or enabling system site packages, weakening environment isolation.

Detection Guidance

Check virtualenv version with pip show virtualenv. If version is 21.14.8 or below, the system is vulnerable. Inspect pyvenv.cfg files in virtual environments for unexpected configuration lines or path alterations.

Impact Analysis

An attacker with control over the destination path could alter the virtual environment's configuration. This might allow them to change the home directory path, causing the interpreter to load standard-library files from a location they control. Enabling system site packages weakens isolation, potentially exposing the environment to system-wide packages or vulnerabilities.

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or later using pip install --upgrade virtualenv. Avoid using untrusted destination paths for virtual environment creation. Validate all virtual environment paths for line boundary characters.

Hi! I’m here to help you understand CVE-2026-113715. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70