The vulnerability resides in the way virtualenv constructs the activation scripts for bash, zsh and fish. Before version 21.7.13, the scripts wrapped environment paths that were already quoted by shlex.quote in an additional set of quotes. This over‑quoting can break the intended string literal and cause the shell to interpret shell metacharacters as separate commands when the script is sourced. As a result, an attacker who can control the environment path – for example by creating a virtual environment in an arbitrary location or by setting one of the library paths (TCL or Tk) – can get arbitrary command execution with the current user’s privileges. The flaw aligns with OS Command Injection (CWE‑78) and Code Injection (CWE‑94).

The affected product is PyPA's virtualenv tool. All releases prior to 21.7.13 are vulnerable, regardless of the host operating system. The issue is fixed in virtualenv 21.7.13 and later, as the activation scripts no longer add superfluous quotation. An environment manager that installs virtualenv from the Python package index or from source will need to verify that the installed version is at least 21.7.13.

The CVSS score of 7.8 places this vulnerability in the high severity range. EPSS data is not available, but the lack of a CISA KEV listing suggests no widely observed exploitation yet. Nevertheless, the bug requires only that a user source an activation script, so any user who creates or activates a virtual environment can trigger execution. Attackers can craft paths containing shell metacharacters, place the environment in a location that is later used by automated deployment tools, and achieve code execution with the privileges of the environment owner. Prompt patching is advised to prevent this local privilege escalation.