A vulnerability in virtualenv allows attacker-controlled prompt text to be interpreted as executable commands in certain older or less common shell compatibility modes. Specifically, when bash runs with compatibility level 4.2 or lower, or when dash shells inherit an exported PS1 prompt variable, the prompt text can be executed upon drawing the prompt. This occurs because the prompt string is expanded twice, and some paths do not properly escape the prompt text. The issue affects POSIX activation scripts generated by virtualenv versions prior to 2.20.0_1 and 4.7.0_1. The vulnerability requires an attacker to supply malicious prompt text and a user to activate the environment and interact with the shell prompt. A fix is available in virtualenv versions 2.20.0_1 and 4.7.0_1.