Command execution via unquoted activation-script paths

Command injection in CPython's venv module allows local users to execute commands when another user activates a crafted virtual environment. EnvBuilder.replace_variables substitutes attacker-controlled environment-directory and prompt strings into shell activation templates without shell-appropriate quoting. Exploitation requires control of the virtual environment path and a separate user to source its activation script; direct use of the environment's Python executable is unaffected.