VULNERABILITY INTELLIGENCE

CVE-2024-9287

CVSS score7.8 HIGH
EPSS probability0.65%
CISA KEVNot currently listed
Published2024-10-22
Last modified2026-10-30
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

Weakness classification

  • cna@python.org: CWE-428
  • nvd@nist.gov: CWE-77

Primary references