Cloudanix VulnDB

CVE-2026-113715

None

CVSS

—

EPSS

0.2%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a popular Python tool for creating isolated environments could let an attacker quietly weaken those isolation boundaries and potentially load unexpected code.

Chainable
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Data Tampering
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The stdlib venv creator in virtualenv prior to 21.14.9 parses pyvenv.cfg using str.splitlines() and merges attacker-controlled keys (home, include-system-site-packages) injected via line-boundary characters such as U+2028 in the destination pathname, altering isolation and standard-library search paths.

Why it matters to the business

Organizations relying on virtualenv face weakened Python environment isolation that can expose system site-packages or redirect interpreter loads, raising risk of dependency conflicts or execution of attacker-controlled code; the 70% EPSS increase in the first six days after publication signals growing attacker interest and requires prompt attention.

How an attack unfolds

An attacker supplies a pathname containing a line-boundary character to the virtualenv creation flow; the resulting pyvenv.cfg is read back, the injected keys override configuration, include-system-site-packages becomes true or home is redirected, and if the attacker also controls the referenced location, malicious standard-library files are loaded on interpreter startup.

How to fix it

Upgrade virtualenv to version 21.14.9 or later; the builtin venv creator is unaffected and may be used as a temporary alternative where feasible.

How to confirm the fix worked

Confirm installed virtualenv version is 21.14.9 or newer; create a test environment and inspect the generated pyvenv.cfg to ensure injected line-boundary keys are rejected.

Typical attack path

  1. Craft a destination pathname embedding U+2028 or similar line-boundary character
  2. Invoke virtualenv using the stdlib venv creator on the malicious path
  3. Trigger pyvenv.cfg generation and subsequent str.splitlines() readback
  4. Inject home or include-system-site-packages keys via the split
  5. Weaken isolation or redirect library loads when the interpreter starts

How to detect it

Search virtualenv creation logs and pyvenv.cfg files for entries containing U+2028, U+2029, or other unusual line terminators; inspect environment metadata for unexpected home or include-system-site-packages values shortly after creation.

What your security team should do

  • Upgrade all virtualenv installations to 21.14.9 within the next sprint
  • Scan codebases and CI pipelines for pinned virtualenv versions below 21.14.9
  • Review existing virtual environments for unexpected include-system-site-packages or home settings
  • Increase monitoring of virtualenv creation events given the rising EPSS trend

The record

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities