The vulnerability stems from a mishandling of quotation and escape processing in the FishActivator of virtualenv. Fish’s shell syntax treats backslashes and single quotes differently from POSIX shlex, yet the activator used shlex.quote(). When an attacker-controlled environment path, --prompt argument, or VIRTUALENV_PROMPT contains a backslash preceding a quote, the injected fish literal can terminate prematurely and trigger command substitution, allowing the user who sources activate.fish to execute arbitrary commands within the environment. The affected weakness identifiers include CWE-116 (Improper Encoding), CWE-78 (OS Command Injection), and CWE-94 (Improper Control of Generation of Code). The consequence is that any user who activates the virtual environment can run arbitrary code, potentially compromising the host system or data stored therein. This flaw does not grant network access to an attacker; it is a local privilege escalation that depends on the user’s ability to influence the environment variables or command line arguments used when creating the virtual environment.

The issue appears in versions of the PyPA virtualenv tool released before 21.14.2. Systems running those earlier releases of virtualenv on any platform that uses the Fish shell for activation are susceptible. The vulnerability is limited to the virtualenv installation, not the underlying Python interpreter or system libraries.

The CVSS score of 7.8 reflects a high severity for local code execution, though the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited observed abuse. Attack exploitation requires an attacker to influence the environment path, prompt string, or VIRTUALENV_PROMPT, typically by installing a malicious package or modifying environment settings beforehand. Once activated, the compromised environment allows the execution of arbitrary commands. The primary attack vector is a local user who sources activate.fish, potentially through malicious package installers or shell scripts that set VIRTUALENV_PROMPT. Proper mitigation requires version update before an attacker can exploit the flaw.