virtualenv’s activate script assigns the environment name to the shell prompt variable PS1 without sanitizing special characters. When a user runs the activated environment in zsh with the PROMPT_SUBST option enabled, the prompt is re-evaluated each time it is drawn, allowing an attacker who can influence the environment directory name or set the VIRTUALENV_PROMPT variable to inject shell metacharacters that are expanded and executed as commands. This flaw therefore provides local command execution within the user's shell context and could be leveraged for privilege escalation if the user’s shell is running with elevated privileges. The weakness aligns with CWE‑116 (Improper Encoding) and CWE‑78 (OS Command Injection).

The issue affects PyPA’s virtualenv tool versions prior to 21.14.4, including the range 21.13.0 through 21.14.3, documented in the release notes and commit history. Users can verify their installed version and upgrade to 21.14.4 or later, where the vulnerability is fixed.

The vulnerability carries a CVSS score of 7.8, indicating a high severity. The EPSS score is below 1%, suggesting a relatively low likelihood of exploitation at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is a local adversary who can control the name of an activated virtual environment or the VIRTUALENV_PROMPT variable on a system running zsh with PROMPT_SUBST enabled; each prompt redraw will execute any injected command.