CVE-2026-113715 is a low-severity vulnerability in virtualenv's venv creator configuration readback. The issue arises because virtualenv reads the standard library's pyvenv.cfg file using splitlines(), which treats certain Unicode line-boundary characters (e.g., U+2028) as line breaks. An attacker-controlled destination path containing such characters can inject additional configuration keys, altering environment settings like 'home' and 'include-system-site-packages'. This can change which standard-library files the interpreter loads and weaken environment isolation. The vulnerability requires using the venv creator in virtualenv and an attacker-controlled destination path with line-boundary characters. A fix was introduced in pull request #3426, which rejects line-boundary characters before creation and rebuilds the configuration from selected settings.