CVE-2026-102938: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in pypa virtualenv
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.
AI Analysis
Technical Summary
The vulnerability arises because PyEnvCfg.write() writes prompt values verbatim into the pyvenv.cfg file, while PyEnvCfg._read_values() parses this file using str.splitlines() and accepts the last value for duplicate keys. An attacker who can control the --prompt, VIRTUALENV_PROMPT, or configuration input can insert CRLF sequences to create new lines and keys, such as 'home', thereby influencing the environment configuration. This can lead to the use of an attacker-selected base interpreter or corrupted metadata. The vulnerability is fixed in virtualenv version 21.7.11.
Potential Impact
If an attacker can supply prompt input from outside the operator's trust boundary, they may manipulate the virtual environment configuration to use a malicious base interpreter or corrupt environment metadata. Directly supplied prompt content by the operator primarily risks corrupting their own environment rather than enabling broader attacks.
Mitigation Recommendations
Upgrade virtualenv to version 21.7.11 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 21.7.11.
CVE-2026-102938: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in pypa virtualenv
Description
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.
CVSS v4.0
Score 5.8medium
Affected software
pypa
virtualenv
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because PyEnvCfg.write() writes prompt values verbatim into the pyvenv.cfg file, while PyEnvCfg._read_values() parses this file using str.splitlines() and accepts the last value for duplicate keys. An attacker who can control the --prompt, VIRTUALENV_PROMPT, or configuration input can insert CRLF sequences to create new lines and keys, such as 'home', thereby influencing the environment configuration. This can lead to the use of an attacker-selected base interpreter or corrupted metadata. The vulnerability is fixed in virtualenv version 21.7.11.
Potential Impact
If an attacker can supply prompt input from outside the operator's trust boundary, they may manipulate the virtual environment configuration to use a malicious base interpreter or corrupt environment metadata. Directly supplied prompt content by the operator primarily risks corrupting their own environment rather than enabling broader attacks.
Mitigation Recommendations
Upgrade virtualenv to version 21.7.11 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 21.7.11.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-29T20:24:43.340Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abc287d680226ef6848d2d4
Added to database: 09/29/2026, 21:07:09 UTC
Last enriched: 09/29/2026, 21:21:43 UTC
Last updated: 09/30/2026, 03:11:45 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.