Dev.to Security 🔐 Cybersecurity Sat, 24 Oct 2026 06:30:49 +0000 👁 0 📖 1 min read

CVE-2026-113715: CVE-2026-113715: Configuration Key Injection via Unicode Line Boundary in virtualenv

CVE-2026-113715: Configuration Key Injection via Unicode Line Boundary in virtualenv Vulnerability ID: CVE-2026-113715 CVSS Score: 2.0 Published: 2026-10-23 In virtualenv versions prior to 21.14.9, creating isolated

CVE-2026-113715: Configuration Key Injection via Unicode Line Boundary in virtualenv

Vulnerability ID: CVE-2026-113715
CVSS Score: 2.0
Published: 2026-10-23

In virtualenv versions prior to 21.14.9, creating isolated Python virtual environments using the standard library creator (--creator venv) allows configuration key injection into pyvenv.cfg if an attacker can control or influence the destination directory path containing Unicode line break characters.

TL;DR

virtualenv prior to 21.14.9 fails to sanitize Unicode line break characters in destination directory paths, allowing configuration parameter injection into pyvenv.cfg when using the stdlib venv creator.

Technical Details

Vulnerability ID: CVE-2026-113715 / GHSA-qmx5-4p3x-wvqf
CWE ID: CWE-93 (Improper Neutralization of CRLF Sequences)
CVSS v4.0 Score: 2.0 (Low)
CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected Component: virtualenv (--creator venv)
Exploit Maturity: None (No public exploit)
Patched Version: 21.14.9

Affected Systems

virtualenv (PyPI package prior to 21.14.9)
virtualenv: < 21.14.9 (Fixed in: 21.14.9)

Code Analysis

Commit: b0008a5

Fix pyvenv.cfg CRLF / line boundary injection via venv creator path

Mitigation Strategies

Upgrade virtualenv to version 21.14.9 or higher.
Validate and sanitize untrusted target directory paths prior to environment creation.
Ensure virtualenv execution does not take unescaped file path inputs directly from unauthenticated users.

Remediation Steps:

Run pip install --upgrade 'virtualenv>=21.14.9' in your build environments.
Audit automated deployment scripts calling virtualenv --creator venv with user-supplied paths.
Verify system installations using virtualenv --version.

References

Read the full report for CVE-2026-113715 on our website for more details including interactive diagrams and full exploit analysis.

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

← News 🔐 Cybersecurity 🏠 Home