CVE-2026-113715 pypa CVE debrief

Who should care

Defenders responsible for virtualenv environments, especially those created with untrusted caller-influenced destination pathnames, should assess exposure and prioritize verification of patch status in their deployment contexts.

Why it matters

The vulnerability in virtualenv's venv configuration readback can lead to potential configuration manipulation if an untrusted caller influences the destination pathname passed to the venv creator. Defenders should prioritize verifying the patch status of virtualenv environments and assess exposure in their deployment contexts.

• Verify patch status of virtualenv environments to prevent potential configuration manipulation
• Assess exposure in deployment contexts where untrusted callers may influence destination pathnames
• Inventory virtualenv environments to identify potential exposure
• Apply the patch to virtualenv version 21.14.9 or later to prevent potential configuration manipulation

Technical summary

The venv creator in virtualenv reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over virtualenv's configuration. This can lead to line-boundary characters from destination data becoming configuration structure before output sanitization. An untrusted caller must influence the destination pathname passed to the venv creator, and that pathname must contain a character that Python treats as a line boundary.

Defensive priority

Defenders should prioritize verifying the patch status of virtualenv environments, especially those created with untrusted caller-influenced destination pathnames, and assess exposure in their deployment contexts.

Recommended defensive actions

• Verify the patch status of virtualenv environments, especially those created with untrusted caller-influenced destination pathnames
• Assess exposure in deployment contexts where untrusted callers may influence destination pathnames
• Inventory virtualenv environments to identify potential exposure
• Apply the patch to virtualenv version 21.14.9 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability involves the venv creator in virtualenv reading the standard library's generated pyvenv.cfg with splitlines() and merging all resulting keys over virtualenv's configuration. This can lead to line-boundary characters from destination data becoming configuration structure before output sanitization. An untrusted caller must influence the destination pathname passed to the venv creator, and that pathname must contain a character that Python treats as a line boundary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.