virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh
    activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8
    activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such
    as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the
    literal to close and attacker-influenced statements to execute when the user sources the generated script.
    This issue is fixed in version 21.14.9. (CVE-2026-113718)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh     activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8     activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such     as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the     literal to close and attacker-influenced statements to execute when the user sources the generated script.
    This issue is fixed in version 21.14.9. (CVE-2026-113718)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477209	SCA: security update for virtualenv (GHSA-394h-qwmc-48pf)	Tenable Cloud Security	SCA Checks	Local	high
477209	SCA: security update for virtualenv (GHSA-394h-qwmc-48pf)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
370948	Linux Distros Unpatched Vulnerability : CVE-2026-113718	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-113718

high

Tenable Plugins

high

high

high