virtualenv: Venv configuration readback can reinterpret path boundaries

影響: pip:virtualenv < 21.14.9 → 21.14.9

The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner reported this as ANT-2026-6ZQHJ6VI in virtualenv-20261015-005, received on 15 October 2026. Affected area Configuration readback by the stdlib venv creator. Attacker-controlled input An untrusted caller must…

GitHub Advisory Databaseで読む

2026/10/24 07:20、GitHub Advisory Databaseが「virtualenv: Venv configuration readback can reinterpret path boundaries」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: Python。CVE: CVE-2026-113715。