DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-102938: CVE-2026-102938: Configuration Injection and Local Execution Hijack in virtualenv

#security #cve #cybersecurity

CVE-2026-102938: Configuration Injection and Local Execution Hijack in virtualenv

Vulnerability ID: CVE-2026-102938
CVSS Score: 5.8
Published: 2026-09-30

An input validation vulnerability in the virtualenv package allows local execution hijacking via configuration injection. When generating the pyvenv.cfg configuration file, user-controlled parameters such as prompt options are written verbatim without sanitizing line-boundary sequences. This allows attackers to inject arbitrary configuration options, causing the tool to read malicious base interpreter paths.

TL;DR

virtualenv prior to 21.7.11 is vulnerable to configuration injection. By injecting unicode line-boundary characters into the prompt configuration parameter, an attacker can override the home configuration key, redirecting downstream python executions to a malicious binary.

Technical Details

  • CWE ID: CWE-93
  • Attack Vector: Local
  • CVSS v4.0 Score: 5.8
  • EPSS Score: 0.00043
  • Impact: High Integrity, Low Confidentiality, Low Availability
  • Exploit Status: none
  • KEV Status: Not Listed

Affected Systems

  • Python environments utilizing virtualenv configurations
  • CI/CD build pipelines and automated testing hosts executing virtualenv creation scripts
  • virtualenv: < 21.7.11 (Fixed in: 21.7.11)

Code Analysis

Commit: a30f995

Fix pyvenv.cfg configuration injection via line boundaries in prompt values

Mitigation Strategies

  • Upgrade virtualenv to version 21.7.11 or later
  • Sanitize CLI parameters and environment variables of unicode line delimiters in wrapper scripts
  • Enforce least-privilege execution permissions on automation systems running virtualenv

Remediation Steps:

  1. Execute pip install --upgrade virtualenv>=21.7.11 to patch local environments
  2. Review automated orchestration files to sanitize input assigned to --prompt options
  3. Run file integrity and parsing audits on deployed pyvenv.cfg files to discover duplicate directives

References

Read the full report for CVE-2026-102938 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)