Threats tagged 'bit-virtualenv-2026-113715'

A vulnerability in virtualenv prior to version 21.14.9 allows an untrusted caller who can influence the destination pathname to inject line-boundary characters into the pyvenv.cfg configuration file. This can alter configuration keys such as 'home' and 'include-system-site-packages', potentially weakening environment isolation or changing the standard library files loaded by the interpreter. The issue is fixed in version 21.14.9.