{"id":"ghsa-ghsa-qmx5-4p3x-wvqf","seq":661286,"kind":"advisory","title":"virtualenv: Venv configuration readback can reinterpret path boundaries","url":"https://github.com/advisories/GHSA-qmx5-4p3x-wvqf","permalink":"https://vulnpulse.app/items/ghsa-ghsa-qmx5-4p3x-wvqf","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nThe venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner reported this as ANT-2026-6ZQHJ6VI in virtualenv-20261015-005, received on 15 October 2026. Affected area Configuration readback by the stdlib venv creator. Attacker-controlled input An untrusted caller must…","severity":"low","techs":["python"],"cves":["CVE-2026-113715"],"tags":["GHSA-qmx5-4p3x-wvqf","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:20:43.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}