{"id":"ghsa-ghsa-394h-qwmc-48pf","seq":661283,"kind":"advisory","title":"virtualenv: Xonsh activation literals depend on the script decoding codec","url":"https://github.com/advisories/GHSA-394h-qwmc-48pf","permalink":"https://vulnpulse.app/items/ghsa-ghsa-394h-qwmc-48pf","summary":"影響: pip:virtualenv < 21.14.9 → 21.14.9\nCaller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can change how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure through unrelated activators. Attacker-control…","severity":"high","techs":["python"],"cves":["CVE-2026-113718"],"tags":["GHSA-394h-qwmc-48pf","virtualenv"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:24:43.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}