A vulnerability in virtualenv's venv creator allows attacker-controlled pathnames containing Unicode line boundary characters (e.g., U+2028) to inject additional configuration keys into the pyvenv.cfg file during readback. This can alter the 'home' path and 'include-system-site-packages' setting, potentially changing the interpreter's standard library location and weakening environment isolation. The issue affects virtualenv versions from 20.0.0b1 up to but not including 2.5.1_1. A fix is available in version 2.5.1_1.