virtualenv: Venv configuration readback can reinterpret path boundaries

影響: pip:virtualenv < 21.14.9 → 21.14.9

The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner reported this as ANT-2026-6ZQHJ6VI in virtualenv-20261015-005, received on 15 October 2026. Affected area Configuration readback by the stdlib venv creator. Attacker-controlled input An untrusted caller must…

在 GitHub Advisory Database 阅读

2026/10/24 07:20，GitHub Advisory Database 发布了“virtualenv: Venv configuration readback can reinterpret path boundaries”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：Python。CVE：CVE-2026-113715。