Threats tagged 'brew-virtualenvwrapper-cve-2026-102938'

Virtualenvwrapper versions before 4.8.4_2 and 6.1.1_3 improperly handle line boundaries in the 'prompt' value written to pyvenv.cfg, allowing crafted prompts containing line breaks to inject or overwrite configuration keys such as 'home'. This can mislead tooling that relies on 'home' to locate the base interpreter. The vulnerability requires the prompt to be influenced by external, untrusted input, such as CI job templates or environment variables. A patch is available that sanitizes line boundaries by collapsing them to spaces during serialization.