CVE-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
Attackers can inject configuration keys into pyvenv.cfg via prompt values, potentially forcing the use of a malicious base interpreter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-102938?
CVE-2026-102938 is a medium-severity vulnerability in pypa virtualenv, published on 29 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.
Weakness: CWE-93
Which versions are affected by CVE-2026-102938?
4 open source packages ship an affected version, including virtualenv.
| Package | Affected | Fixed in |
|---|---|---|
virtualenv Bitnami | All versions | 21.7.11 |
virtualenv PyPI | All versions | 21.7.11 |
virtualenv PyPI | All versions | 21.7.11 |
virtualenv PyPI | All versions | 21.7.11 |
How do I fix CVE-2026-102938?
Upgrade virtualenv to 21.7.11 or later.
Is CVE-2026-102938 being exploited?
There is no known exploitation of CVE-2026-102938 in the wild and no public exploit code.
Sources
Also known as AZL-105672, BIT-virtualenv-2026-102938, DEBIAN-CVE-2026-102938, ECHO-50c8-2dcc-b664, GHSA-9h9j-4vrj-gf7g, MINI-cxmx-fcq7-hcg4 and 3 more.