CVE-2026-113715 is a low-severity vulnerability in virtualenv's venv creator configuration readback. The issue arises because virtualenv reads the standard library's pyvenv.cfg file using splitlines(), which treats certain Unicode line boundary characters (e.g., U+2028) as line breaks. An attacker controlling the destination path passed to the venv creator can inject configuration keys by including such characters, causing virtualenv to merge malicious keys into its configuration. This can alter the environment's home path and enable inclusion of system site packages, weakening isolation. The vulnerability affects virtualenv versions from 1.9.3 up to but not including 1.18.1_2. A fix is available in version 1.18.1_2 that rejects line-boundary characters before creation and rebuilds the configuration safely.