PyPA virtualenv EUVD-2026-105299

Requires all of the following to coincide: (1) the target uses the xonsh shell with its POSIX activation script generated by a vulnerable virtualenv (prior to 21.14.9); (2) xonsh reads that script under a legacy multibyte codec such as GBK or Big5 via the $XONSH_ENCODING setting (non-default for most Western/UTF-8 environments); (3) the virtualenv prompt or destination path contains attacker-influenced printable non-ASCII characters positioned so a UTF-8 trail byte consumes the backslash before an adjacent quote; and (4) the victim actively sources the generated activate.xsh (UI:A). These layered requirements - specific shell, specific non-default encoding, attacker control over prompt/path data, and victim interaction - substantially limit realistic exploitation and explain the AC:H/AT:P/UI:A rating.

This is a moderate-priority, condition-dependent code injection (CWE-94) in PyPA virtualenv, not a drop-everything issue. The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:A, score 7.1) is internally consistent with the description: exploitation is local, requires a specific precondition (AT:P - a legacy multibyte codec such as GBK/Big5 set via $XONSH_ENCODING), is high-complexity (AC:H - depends on a UTF-8 trail byte consuming an escaping backslash), and needs active user interaction (UI:A - the victim must source the generated activate.xsh). No CVSS 3.1 vector, EPSS score, KEV entry, or POC was provided in the input. There is no public exploit identified at time of analysis, and the product is not in CISA KEV, so there is no evidence of active exploitation despite the HIGH confidentiality/integrity/availability impact. The gating factors (xonsh shell + non-UTF-8 legacy encoding + attacker-influenced prompt/path data + victim sourcing the script) make real-world exploitation narrow and targeted rather than widespread, which is why the raw HIGH impact should not be read as broad urgency. Missing data to note: no EPSS and no independent POC assessment are available, so exploitation likelihood is inferred from the CVSS vector and description alone.

An attacker influences the virtualenv prompt string or destination path with crafted non-ASCII data; virtualenv's xonsh activator writes it via repr() into a UTF-8 activate.xsh. When a victim whose xonsh is configured with a legacy multibyte codec (GBK/Big5) sources that script, a UTF-8 trail byte consumes the backslash escaping an adjacent quote, closing the literal early and executing attacker-controlled statements in the victim's shell. No public exploit code was provided in the input.