CVE-2026-113718High· 7.1▾ Twilightvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.
virtualenv < 21.14.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113776High· 7.8virtualenv activation scripts run code from a path that contains a placeholder name
CVE-2026-113716Medium· 4.5virtualenv: Builtin creation follows linked environment directories
CVE-2026-113714Low· 2.3virtualenv: Downloaded wheel selection and caching precede verification
CVE-2026-113717Low· 2.3virtualenv: Pip seeding with download omits wheel digest verification
CVE-2026-113719Medium· 4.5virtualenv: Seed replacement does not contain metadata deletion paths
CVE-2026-113715Low· 2.0virtualenv: Venv configuration readback can reinterpret path boundaries