virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

virtualenv activation scripts run code from a path that contains a placeholder name

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv bash activate runs commands from an environment name with a backslash before $

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv: Command injection via --prompt in activate.bat (batch activator)

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv: Xonsh activation literals depend on the script decoding codec