virtualenv: Venv configuration readback can reinterpret path boundaries
影響: pip:virtualenv < 21.14.9 → 21.14.9
The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner reported this as ANT-2026-6ZQHJ6VI in virtualenv-20261015-005, received on 15 October 2026. Affected area Configuration readback by the stdlib venv creator. Attacker-controlled input An untrusted caller must…
Read on GitHub Advisory Database
| CVE | CVE-2026-113715 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/24/2026, 01:50 PM |
| Data | Markdown JSON |
On 10/24/2026, 07:20 AM, GitHub Advisory Database published "virtualenv: Venv configuration readback can reinterpret path boundaries" (type: Advisory). Severity is "Low" (low). Related technologies: Python. CVE: CVE-2026-113715.