A vulnerability in virtualenv versions from 20.26.6 up to but not including 21.14.2 allows code execution when activating a virtual environment. The issue arises because the activation scripts replace placeholders in the environment path or prompt in multiple passes, enabling crafted values containing placeholder names to break out of quoting and execute arbitrary code during activation. This affects activation via bash, fish, xonsh, or activate_this.py. The vulnerability is fixed in version 21.14.2.