CVE-2026-113718: Code Injection in pypa/virtualenv XonshActivator via Multibyte Encoding Misalignment

Vulnerability ID: CVE-2026-113718
CVSS Score: 7.1
Published: 2026-10-23

A code injection vulnerability in pypa/virtualenv prior to version 21.14.9 allows arbitrary command execution in xonsh shells using legacy multibyte encodings when sourcing activate.xsh.

TL;DR

Legacy multibyte encodings swallow escaping backslashes in virtualenv xonsh activation scripts, leading to shell literal breakout and code injection.

Technical Details

• CWE ID: CWE-94
• Attack Vector: Local
• CVSS v4.0 Score: 7.1 (High)
• EPSS Score: 0.00142 (3.23 percentile)
• Vulnerability Impact: Code Injection / Command Execution
• Exploit Availability: No Public Exploit
• CISA KEV Status: Not Listed

Affected Systems

• pypa/virtualenv < 21.14.9
• xonsh shell activation environments using legacy multibyte encodings ($XONSH_ENCODING)
• virtualenv: < 21.14.9 (Fixed in: 21.14.9)

Code Analysis

Commit: e5fc2e6

Keep literals independent of the encoding xonsh uses to read the script

Mitigation Strategies

• Upgrade virtualenv to version 21.14.9 or higher.
• Re-create existing virtual environments to update activate.xsh files on disk.
• Ensure environment configurations use UTF-8 encodings for $XONSH_ENCODING where applicable.

Remediation Steps:

1. Execute 'pip install --upgrade virtualenv' to install version 21.14.9 or later.
2. Regenerate activation scripts for existing virtual environments.
3. Audit activate.xsh files to confirm prompt literals contain pure ASCII escape representations.

References

• GHSA-394h-qwmc-48pf Advisory
• Fix Commit e5fc2e6e189a877ff559af288919e3525d13e5e0
• Pull Request #3432
• Virtualenv Release Tag 21.14.9
• NVD Vulnerability Detail
• CVE.org CVE Record

Read the full report for CVE-2026-113718 on our website for more details including interactive diagrams and full exploit analysis.