Arbitrary Code Execution in Virtualenv by Python Software Foundation

CVE-2026-113718

What is CVE-2026-113718?

A vulnerability exists in the Virtualenv tool prior to version 21.14.9 that can lead to arbitrary code execution. The issue arises due to the xonsh activation script, which improperly uses the repr() function to handle non-ASCII prompts. This results in a situation where under certain multibyte codecs, a UTF-8 trail byte can improperly consume a backslash before an adjacent quote. Consequently, this allows an attacker to influence the execution of user-sourced scripts, posing a significant security risk. The vulnerability is addressed in version 21.14.9, and users are strongly encouraged to upgrade to mitigate potential threats.

References