A vulnerability in virtualenv's venv creator configuration readback allows an attacker to inject configuration keys by including Unicode line-boundary characters in the destination path. This can alter environment settings such as the 'home' directory and 'include-system-site-packages' flag, potentially affecting interpreter behavior and environment isolation. The issue arises because virtualenv reads the standard library's pyvenv.cfg using splitlines(), which treats certain Unicode characters as line boundaries, enabling crafted input to inject new configuration lines. This flaw affects virtualenv versions starting from 6.1.0 up to but not including 6.1.1_4. A fix is available in version 6.1.1_4 that rejects line-boundary characters before creation and rebuilds the configuration safely.