A vulnerability in virtualenv's venv creator allows attacker-controlled pathnames containing Unicode line boundary characters (e.g., U+2028) to inject additional configuration keys into the pyvenv.cfg file during configuration readback. This can alter environment settings such as the 'home' directory and 'include-system-site-packages', potentially changing which standard library files the interpreter loads and weakening environment isolation. The issue affects virtualenv versions from 2022.9.24 up to but not including 2026.10.1. A fix was introduced in version 2026.10.1 that rejects line-boundary characters before creation and rebuilds the configuration from selected settings.