https://vulnerability.circl.lu/sightings/feed 2026-10-06T18:25:34.366381+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c92d30e7-220c-43b9-be35-48bf03f474d8/export 2026-10-06T18:25:34.392528+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c92d30e7-220c-43b9-be35-48bf03f474d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102938", "type": "seen", "source": "https://gist.github.com/alon710/da187b12d6e19cd4179ca1ae4ee90437", "content": "# CVE-2026-102938: CVE-2026-102938: Configuration Injection and Local Execution Hijack in virtualenv\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102938\n\n## Summary\nAn input validation vulnerability in the virtualenv package allows local execution hijacking via configuration injection. When generating the pyvenv.cfg configuration file, user-controlled parameters such as prompt options are written verbatim without sanitizing line-boundary sequences. This allows attackers to inject arbitrary configuration options, causing the tool to read malicious base interpreter paths.\n\n## TL;DR\nvirtualenv prior to 21.7.11 is vulnerable to configuration injection. By injecting unicode line-boundary characters into the prompt configuration parameter, an attacker can override the home configuration key, redirecting downstream python executions to a malicious binary.\n\n## Technical Details\n\n- **CWE ID**: CWE-93\n- **Attack Vector**: Local\n- **CVSS v4.0 Score**: 5.8\n- **EPSS Score**: 0.00043\n- **Impact**: High Integrity, Low Confidentiality, Low Availability\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Python environments utilizing virtualenv configurations\n- CI/CD build pipelines and automated testing hosts executing virtualenv creation scripts\n- **virtualenv**: < 21.7.11 (Fixed in: `21.7.11`)\n\n## Mitigation\n\n- Upgrade virtualenv to version 21.7.11 or later\n- Sanitize CLI parameters and environment variables of unicode line delimiters in wrapper scripts\n- Enforce least-privilege execution permissions on automation systems running virtualenv\n\n**Remediation Steps:**\n1. Execute pip install --upgrade virtualenv>=21.7.11 to patch local environments\n2. Review automated orchestration files to sanitize input assigned to --prompt options\n3. Run file integrity and parsing audits on deployed pyvenv.cfg files to discover duplicate directives\n\n## References\n\n- [GHSA-9h9j-4vrj-gf7g Advisory](https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g)\n- [NVD CVE-2026-102938 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-102938)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102938) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T01:30:28.000000Z"} 2026-10-01T01:30:28+00:00