virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 6
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-27 13:33
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-27 14:16
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-27 13:33
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-22 16:47
- StatusReceived → PublishedNVD modified 2026-10-20 19:39
- First seenCVSS 7.1NVD modified 2026-10-20 20:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0
- https://github.com/pypa/virtualenv/pull/3432
- https://github.com/pypa/virtualenv/releases/tag/21.14.9
- https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf
- https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf