A command injection vulnerability exists in virtualenv versions prior to 21.14.4 when used with zsh shells that have PROMPT_SUBST enabled. The vulnerability arises because the environment name is assigned to the shell prompt (PS1) without proper escaping, allowing attacker-controlled input to execute commands each time the prompt is drawn. This affects virtualenv versions before 21.14.4 and is fixed in 21.14.4.