CVE-2026-113718

UNKNOWN 0.0

virtualenv: Xonsh activation literals depend on the script decoding codec

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.

CWE	CWE-94
Vendor	pypa
Product	virtualenv
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for pypa virtualenv

Be the first to know when new unknown vulnerabilities affecting pypa virtualenv are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

pypa / virtualenv

< 21.14.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf github.com: https://github.com/pypa/virtualenv/pull/3432 github.com: https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0 github.com: https://github.com/pypa/virtualenv/releases/tag/21.14.9