virtualenv versions 21.14.9 through 21.14.12 ship a bash activation script that copies an attacker‑controlled --prompt value into the PS1 variable without escaping shell metacharacters when promptvars and POSIX mode are disabled. The stored prompt is later expanded in the user’s shell, allowing arbitrary command substitution to execute as the activating user. This flaw is a form of command injection (CWE‑78) that can lead to execution of malicious code without prompting the user.

The vulnerability affects the pypa virtualenv tool, specifically releases 21.14.9 through 21.14.12. Upgrading to virtualenv 21.14.13 or later removes the flaw.

The CVSS score is 7.1, indicating a moderate severity. The EPSS score is not available, and the issue is not listed in CISA KEV. Because the exploit requires an attacker‑controlled --prompt during virtual environment creation, the attack vector is local to users who can invoke virtualenv. Once activated, the unescaped prompt can run arbitrary shell commands as the current user, potentially giving the attacker local code execution within that session. However, no remote exploitation or privilege escalation beyond the user’s rights is documented.