The flaw arises from the way virtualenv processes activation templates. When a virtual environment is created, the system applies a second pass of placeholder substitution across the fully rendered activation script. If a user‑defined environment path or prompt contains a placeholder such as __VIRTUAL_NAME__ or __VIRTUAL_ENV__ inside an already quoted string, the second pass rewrites that part of the script. The new value can include shell metacharacters that close the original quote and append arbitrary commands, which are then executed when the user activates the environment through bash, fish, xonsh, or the activate_this.py script. This mechanism enables an attacker to run arbitrary local code by simply supplying a crafted path or prompt. Based on the description, it is inferred that the attacker must have the ability to specify a custom environment path or prompt during environment creation, which typically requires local access.

The vulnerability exists in pypa:virtualenv versions 20.26.6 through 21.14.2, inclusive. Any installation that allows the user to specify a custom environment path or prompt is susceptible. Versions prior to 20.26.6 or 21.14.2 are not affected, and all later releases contain the fixed placeholder‑replacement logic.

With a CVSS score of 7.8, the vulnerability is classified as high severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation at this time, and it is not listed in the CISA KEV catalog. Attackers must control the activation parameters—typically by creating or modifying a virtual environment locally—to trigger the flaw. Once activated, injected commands run with the privileges of the user who activates the environment, potentially allowing privilege escalation or compromise of the local system. Based on the description, it is inferred that the attack vector involves local privilege and requires the attacker to influence environment creation.