Detections
Analytics
SCA: security update for virtualenv (GHSA-qmx5-4p3x-wvqf)
low Tenable Self-Hosted Container Security Plugin ID 477221
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv
creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected
configuration. An untrusted caller who influences the destination pathname can include a line-boundary
character such as U+2028 to inject keys including home and include-system-site-packages, causing path data
to change configuration structure before final output. Setting include-system-site-packages to true
weakens environment isolation, while an altered home can change which standard-library files the
interpreter loads if the attacker also controls that location. The builtin creator does not use this
readback path. This issue is fixed in version 21.14.9. (CVE-2026-113715)
Solution
Update the virtualenv library and its related packages to version 21.14.9 or later.See Also
Plugin Details
Severity: Low
ID: 477221
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/24/2026
Updated: 10/24/2026
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.7
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-113715
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Low
Base Score: 2
Threat Score: 0.4
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/23/2026
Vulnerability Publication Date: 10/20/2026
Reference Information
CVE: CVE-2026-113715
cwe: CWE-93