CVE-2026-102938

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.11

Description The PyEnvCfg.write() function writes prompt values verbatim to the line-oriented pyvenv.cfg format, while PyEnvCfg. read values() parses the file using str.splitlines() and accepts the last value for duplicate keys. An attacker who can influence the --prompt argument, the VIRTUALENV PROMPT variable, or configuration input can insert a line boundary and additional keys, such as home. This can lead to consumers using an attacker-selected base interpreter or corrupted environment metadata. This issue requires prompt input from outside the operator's trust boundary.

Recommendations Update virtualenv to version 21.7.11.