CVE-2026-113715: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in pypa virtualenv

The vulnerability arises because virtualenv versions before 21.14.9 use str.splitlines() to parse the generated pyvenv.cfg file and merge keys over the selected configuration. An attacker controlling the destination pathname can inject line-boundary characters (e.g., U+2028) to insert or modify configuration keys like 'home' and 'include-system-site-packages'. Setting 'include-system-site-packages' to true reduces environment isolation, and altering 'home' can redirect the interpreter to load standard-library files from attacker-controlled locations. The built-in venv creator does not use this readback path and is not affected. The vulnerability is addressed by a fix in version 21.14.9.

An attacker with the ability to influence the destination pathname can manipulate the virtual environment's configuration, potentially weakening isolation by enabling system site packages or redirecting the interpreter to load standard-library files from attacker-controlled paths. This could lead to a reduced security boundary within the virtual environment. However, exploitation requires local access with the ability to influence pathnames, and the overall severity is low.

Upgrade virtualenv to version 21.14.9 or later, where this vulnerability is fixed. No other mitigation is necessary as the issue is resolved in the official release.