GitHub Advisoryadvisory · PyPI

GHSA-rqc4-2hc7-8c8v virtualenv allows command injection through activation scripts for a virtual environment

HIGH Published 2024-11-24 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-53899
Ecosystem
PyPI
Packages
virtualenv
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-78
Reviewed
2025-01-13

Affected packages

• PyPI virtualenv: < 20.26.6 → fixed in 20.26.6

Description

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Related

Alias · CVE (1)

  • CVE-2024-53899 virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References