A vulnerability in virtualenv's xonsh activation script allows attacker-controlled prompt text to become executable code during environment activation if the script is decoded using legacy multibyte encodings like GBK or Big5. This occurs because the UTF-8 encoded activation script contains non-ASCII characters that, when interpreted under these encodings, alter the parsing of string literals, enabling code injection. The issue affects POSIX activation scripts and requires an attacker to control the prompt or destination argument passed to virtualenv, with the user subsequently activating the environment. The vulnerability is fixed in virtualenv version 4.67.0.