CVE-2026-113718

The virtualenv tool is vulnerable to code injection in versions prior to 21.14.9 . The issue exists in the POSIX xonsh activation quote() function, which uses repr() to write non-ASCII data into the UTF-8 activate.xsh script. When using legacy multibyte codecs like GBK or Big5 , a UTF-8 trail byt...