Threats tagged 'brew-hatch-cve-2026-102938'

A vulnerability in Hatch's virtualenv component allows crafted prompt values containing line boundary characters to inject additional configuration lines into the pyvenv.cfg file. This can lead to the replacement of critical configuration keys such as 'home', which is used by tooling to locate the base interpreter. The issue affects versions >=1.2.0 <1.6.2 and >=1.9.3 <1.18.1_1. A fix is available in versions 1.6.2 and 1.18.1_1 that sanitizes line boundaries in prompt values.