Path Traversal in Virtualenv Configuration

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-102938

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

The vulnerability in virtualenv versions before 21.7.11 allows an attacker to manipulate the prompt configuration by inserting line breaks and additional keys into the pyvenv.cfg file. This can cause the environment to use a malicious base interpreter or corrupt metadata.

Impact Analysis

If an attacker influences the prompt input, they could trick the system into using an unauthorized Python interpreter or corrupt environment settings. This primarily affects users who rely on virtualenv for isolated Python environments.

Mitigation Strategies

Upgrade virtualenv to version 21.7.11 or later to address the prompt injection vulnerability in PyEnvCfg.write() and PyEnvCfg._read_values().

Hi! I’m here to help you understand CVE-2026-102938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70