{"id":"AZL-105672","summary":"CVE-2026-102938 affecting package python-virtualenv 20.36.1-6","details":"virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.","modified":"2026-10-04T05:34:07Z","published":"2026-09-29T21:17:19Z","upstream":["CVE-2026-102938"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102938"}],"affected":[{"package":{"name":"python-virtualenv","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-virtualenv"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20.36.1-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105672.json"}}],"schema_version":"1.9.0"}