DEBIAN-CVE-2026-113715

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-113715
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113715.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-113715
Upstream
Published
2026-10-22T22:47:26Z
Modified
2026-10-22T23:00:08Z
Summary
[none]
Details

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.

References

Affected packages

Debian:12 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.17.1+ds-1
20.19.0+ds-1
20.21.0+ds-1
20.23.0+ds-1
20.23.0+ds-2
20.24.1+ds-1
20.24.6+ds-1
20.24.6+ds-2
20.25.0+ds-1
20.25.0+ds-2
20.25.1+ds-1
20.26.1+ds-1
20.26.2+ds-1
20.26.6+ds-1
20.27.0+ds-1
20.28.0+ds-1
20.29.1+ds-1
20.29.3+ds-1
20.30.0+ds-1
20.30.0+ds-2
20.30.0+ds-3
20.31.2+ds-1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113715.json"

Debian:13 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.31.2+ds-1
20.31.2+ds-1+deb13u1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113715.json"

Debian:14 / python-virtualenv

Package

Name
python-virtualenv
Purl
pkg:deb/debian/python-virtualenv?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

20.*
20.31.2+ds-1
20.33.1+ds-1
20.34.0+ds-1
20.35.3+ds-1
20.35.4+ds-1
20.36.1+ds-1
20.38.0+ds-1
21.*
21.2.0+ds-1
21.2.4+ds-1
21.3.1+ds-1
21.4.1+ds-1
21.5.1+ds-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-113715.json"