A vulnerability in virtualenv's venv creator configuration readback allows specially crafted destination paths containing Unicode line boundary characters (e.g., U+2028) to inject additional configuration keys into the pyvenv.cfg file. This can alter environment settings such as the 'home' directory and 'include-system-site-packages' flag, potentially changing which standard library files the interpreter loads and weakening environment isolation. The issue affects virtualenv versions from 20.2.1 up to but not including 20.9.3_2 and from 20.12.3 up to but not including 20.29.3. A fix is available in versions 20.9.3_2 and 20.29.3.