A vulnerability in virtualenv's venv creator allows attacker-controlled pathnames containing Unicode line boundary characters (e.g., U+2028) to inject additional configuration keys into the pyvenv.cfg file during readback. This can alter environment settings such as 'home' and 'include-system-site-packages', potentially changing which standard library files the interpreter loads and weakening environment isolation. The issue affects virtualenv versions starting from 20.0.0b1 until fixed in 2.20.0_1 and 4.7.0_1. The vulnerability is low severity with a CVSS 4.0 score of 2. A patch is available that rejects line-boundary characters before creation and rebuilds the configuration from selected settings.