CVE-2026-113715 is a low-severity vulnerability in virtualenv's venv creator configuration readback. It arises because virtualenv reads the standard library's pyvenv.cfg file using splitlines(), which treats certain Unicode line boundary characters (e.g., U+2028) as line breaks. An attacker-controlled destination path containing such characters can inject additional configuration keys into virtualenv's settings, altering environment behavior such as the 'home' directory and site-packages inclusion. This can weaken environment isolation and change which standard library files the interpreter loads. The issue affects virtualenv versions from 3.27.0 up to but not including 4.67.0. A fix is available in version 4.67.0 that rejects line-boundary characters before creation and rebuilds the configuration safely.