CVEvulnerability

CVE-2024-9287

5.3 MEDIUM Published 2024-10-22 Modified 2026-10-30 Official page ↗
Status
Modified
Published
2024-10-22
Last modified
2026-10-30
Assigner
[email protected]
CVSS 4.0 ([email protected])
5.3 MEDIUM — CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-428, CWE-77

Description

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

Affected configurations

• python python (< 3.9.21) • python python (>= 3.10.0 < 3.10.16) • python python (>= 3.11.0 < 3.11.11) • python python (>= 3.12.0 < 3.12.8) • python python (>= 3.13.0 < 3.13.1) • python python 3.14.0

Related

Weakness · CWE (2)

  • CWE-428 Unquoted Search Path or Element weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References