CVE-2026-102938: virtualenv Configuration Injection via Unvalidated Prompt Values
Summary
CVE-2026-102938: pyvenv.cfg is a line-based format with no escape syntax. Affects virtualenv versions < 21.7.11. Fixed in 21.7.11. How to fix ↓
Also tracked for
- virtualenv · Bitnami
The same CVE-2026-102938 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
virtualenv is a popular Python package that allows users to create isolated Python environments. This functionality is crucial for managing dependencies and avoiding conflicts between projects. The package is widely used in development and production environments, making its security a significant concern. The vulnerability in question arises from the way virtualenv handles prompt values in its configuration file, pyvenv.cfg.
Vulnerability Detail
The vulnerability stems from the fact that virtualenv writes prompt values into the pyvenv.cfg file without sanitizing line boundaries. This allows an attacker to inject additional configuration lines by crafting a malicious prompt. The injected lines can overwrite existing configuration settings, such as the home directory of the virtual environment, which can lead to the execution of unintended code or the use of an incorrect Python interpreter. The issue is exacerbated by the fact that the prompt can be set through various means, including environment variables and CI/CD pipelines, making it possible for untrusted input to affect the configuration.
How To Fix
Latest published version: 21.14.12 as of 22 Oct 2026
pip install --upgrade "virtualenv==21.14.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.7.11
This is the first release that contains the fix.
pip install --upgrade "virtualenv==21.7.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using untrusted input for the prompt value. Ensure that the prompt is set only through trusted sources and avoid using dynamic values that could be influenced by external inputs.
Conclusion
The CVE-2026-102938 vulnerability in virtualenv poses a significant risk due to its potential for configuration injection through unvalidated prompt values. Users are strongly advised to update to the latest version to mitigate this risk and ensure the security of their Python environments.
See every vulnerability recorded for virtualenv →
FAQ
CVE-2026-102938 is a vulnerability in the virtualenv package that allows for configuration injection through unvalidated prompt values in the pyvenv.cfg file.
If your application uses virtualenv and accepts untrusted input for the prompt, an attacker could manipulate the configuration to point to a malicious Python interpreter or execute unintended code.
All versions of virtualenv prior to 21.7.11 are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without signing up.
If you cannot update virtualenv right away, ensure that the prompt value is sourced from trusted inputs only and avoid using dynamic or user-supplied data.
References
Related vulnerabilities
Recent vulnerabilities recorded for virtualenv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
