CVE-2026-113715 virtualenv: Venv configuration readback can reinterpret path boundaries

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

CVE-2026-113715

The virtualenv tool (prior to version 21.14.9 ) is vulnerable to a configuration injection issue due to improper neutralization of line-boundary characters like U+2028 . An untrusted caller who can influence the destination pathname can inject keys such as home or include-system-site-packages int...