A command injection vulnerability exists in virtualenv versions prior to 21.14.2 due to improper quoting in the Fish shell activation script. An attacker-controlled environment path or prompt containing a backslash before a quote can cause command substitution when sourcing activate.fish. This issue is fixed in version 21.14.2.