https://github.com/python/cpython/commit/d9825d504ad738a5160d3c3ecd8cd575a1713e98
commit: d9825d504ad738a5160d3c3ecd8cd575a1713e98
branch: main
author: Jelle Zijlstra <[email protected]>
committer: JelleZijlstra <[email protected]>
date: 2026-10-27T05:02:50Z
summary:
gh-160279: Keep the venv directory off the import path when running pip
(#160282)
files:
A Misc/NEWS.d/next/Security/2026-10-22-11-09-30.gh-issue-160279.9BtxeF.rst
M Lib/test/test_venv.py
M Lib/venv/__init__.py
diff --git a/Lib/test/test_venv.py b/Lib/test/test_venv.py
index 2f30d3108021dc6..a7595967ba8141a 100644
--- a/Lib/test/test_venv.py
+++ b/Lib/test/test_venv.py
@@ -1330,7 +1330,13 @@ def test_devnull(self):
def do_test_with_pip(self, system_site_packages):
rmtree(self.env_dir)
+ os.mkdir(self.env_dir)
+ # Both ensurepip and its pip subprocess run with the venv as cwd.
+ for name in ('ensurepip.py', 'subprocess.py'):
+ pathlib.Path(self.env_dir, name).write_text(
+ 'raise AssertionError(__file__)\n', encoding='utf-8')
with EnvironmentVarGuard() as envvars:
+ envvars["PYTHONSAFEPATH"] = ""
# pip's cross-version compatibility may trigger deprecation
# warnings in current versions of Python. Ensure related
# environment settings don't cause venv to fail.
diff --git a/Lib/venv/__init__.py b/Lib/venv/__init__.py
index 38e1bfe0c5fdb9d..fc55c248cd54f90 100644
--- a/Lib/venv/__init__.py
+++ b/Lib/venv/__init__.py
@@ -446,14 +446,15 @@ def setup_python(self, context):
def _call_new_python(self, context, *py_args, **kwargs):
"""Executes the newly created Python using safe-ish options"""
# gh-98251: We do not want to just use '-I' because that masks
- # legitimate user preferences (such as not writing bytecode). All we
- # really need is to ensure that the path variables do not overrule
- # normal venv handling.
+ # legitimate user preferences (such as not writing bytecode).
args = [context.env_exec_cmd, *py_args]
kwargs['env'] = env = os.environ.copy()
env['VIRTUAL_ENV'] = context.env_dir
env.pop('PYTHONHOME', None)
env.pop('PYTHONPATH', None)
+ # Keep the working directory off sys.path, including in the
+ # subprocess that ensurepip starts to run pip.
+ env['PYTHONSAFEPATH'] = '1'
kwargs['cwd'] = context.env_dir
kwargs['executable'] = context.env_exec_cmd
subprocess.check_output(args, **kwargs)
diff --git
a/Misc/NEWS.d/next/Security/2026-10-22-11-09-30.gh-issue-160279.9BtxeF.rst
b/Misc/NEWS.d/next/Security/2026-10-22-11-09-30.gh-issue-160279.9BtxeF.rst
new file mode 100644
index 000000000000000..d143e742f52b0e1
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-10-22-11-09-30.gh-issue-160279.9BtxeF.rst
@@ -0,0 +1,2 @@
+Prevent :mod:`venv` from importing modules from the root of an existing
+virtual environment when installing or upgrading pip.
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
