Dev.to Security 🔐 Cybersecurity Thu, 01 Oct 2026 01:30:29 +0000 👁 0 📖 1 min read

CVE-2026-102938: CVE-2026-102938: Configuration Injection and Local Execution Hijack in virtualenv

CVE-2026-102938: Configuration Injection and Local Execution Hijack in virtualenv Vulnerability ID: CVE-2026-102938 CVSS Score: 5.8 Published: 2026-09-30 An input validation vulnerability in the virtualenv package a

CVE-2026-102938: Configuration Injection and Local Execution Hijack in virtualenv

Vulnerability ID: CVE-2026-102938
CVSS Score: 5.8
Published: 2026-09-30

An input validation vulnerability in the virtualenv package allows local execution hijacking via configuration injection. When generating the pyvenv.cfg configuration file, user-controlled parameters such as prompt options are written verbatim without sanitizing line-boundary sequences. This allows attackers to inject arbitrary configuration options, causing the tool to read malicious base interpreter paths.

TL;DR

virtualenv prior to 21.7.11 is vulnerable to configuration injection. By injecting unicode line-boundary characters into the prompt configuration parameter, an attacker can override the home configuration key, redirecting downstream python executions to a malicious binary.

Technical Details

CWE ID: CWE-93
Attack Vector: Local
CVSS v4.0 Score: 5.8
EPSS Score: 0.00043
Impact: High Integrity, Low Confidentiality, Low Availability
Exploit Status: none
KEV Status: Not Listed

Affected Systems

Python environments utilizing virtualenv configurations
CI/CD build pipelines and automated testing hosts executing virtualenv creation scripts
virtualenv: < 21.7.11 (Fixed in: 21.7.11)

Code Analysis

Commit: a30f995

Fix pyvenv.cfg configuration injection via line boundaries in prompt values

Mitigation Strategies

Upgrade virtualenv to version 21.7.11 or later
Sanitize CLI parameters and environment variables of unicode line delimiters in wrapper scripts
Enforce least-privilege execution permissions on automation systems running virtualenv

Remediation Steps:

Execute pip install --upgrade virtualenv>=21.7.11 to patch local environments
Review automated orchestration files to sanitize input assigned to --prompt options
Run file integrity and parsing audits on deployed pyvenv.cfg files to discover duplicate directives

References

Read the full report for CVE-2026-102938 on our website for more details including interactive diagrams and full exploit analysis.

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

← News 🔐 Cybersecurity 🏠 Home