CVE-2026-113718 is a vulnerability in virtualenv's xonsh activation script where attacker-controlled prompt text can become executable code due to encoding mismatches. The issue arises when the activation script is read using legacy multibyte encodings like GBK or Big5 instead of UTF-8, causing backslash escapes to be misinterpreted and allowing injected code execution during environment activation. This affects POSIX xonsh activation scripts and requires an attacker to control the prompt or destination argument passed to virtualenv and a user to source the generated activation script. The vulnerability is fixed in virtualenv version 2026.10.1.