## virtualenv: Venv configuration readback can reinterpret path boundaries

- 種別: advisory
- 重大度: low
- 関連技術: python
- CVE: CVE-2026-113715
- 公開日時: 2026-10-23T22:20:43.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-qmx5-4p3x-wvqf)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-qmx5-4p3x-wvqf

影響: pip:virtualenv < 21.14.9 → 21.14.9
The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner reported this as ANT-2026-6ZQHJ6VI in virtualenv-20261015-005, received on 15 October 2026. Affected area Configuration readback by the stdlib venv creator. Attacker-controlled input An untrusted caller must…