virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv
    creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected
    configuration. An untrusted caller who influences the destination pathname can include a line-boundary
    character such as U+2028 to inject keys including home and include-system-site-packages, causing path data
    to change configuration structure before final output. Setting include-system-site-packages to true
    weakens environment isolation, while an altered home can change which standard-library files the
    interpreter loads if the attacker also controls that location. The builtin creator does not use this
    readback path. This issue is fixed in version 21.14.9. (CVE-2026-113715)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv     creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected     configuration. An untrusted caller who influences the destination pathname can include a line-boundary     character such as U+2028 to inject keys including home and include-system-site-packages, causing path data     to change configuration structure before final output. Setting include-system-site-packages to true     weakens environment isolation, while an altered home can change which standard-library files the     interpreter loads if the attacker also controls that location. The builtin creator does not use this     readback path. This issue is fixed in version 21.14.9. (CVE-2026-113715)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477221	SCA: security update for virtualenv (GHSA-qmx5-4p3x-wvqf)	Tenable Cloud Security	SCA Checks	Local	low
477221	SCA: security update for virtualenv (GHSA-qmx5-4p3x-wvqf)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
370956	Linux Distros Unpatched Vulnerability : CVE-2026-113715	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-113715

low

Tenable Plugins

low

low

low