virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-docutilsUpgrade python3-noseUpgrade python3-PyMySQLUpgrade python3-pymongoUpgrade python-nose-docsUpgrade python3-wheelUpgrade python36-debugUpgrade python36-rpm-macrosUpgrade python3-virtualenvUpgrade python-virtualenv-docUpgrade python36-develUpgrade python3-distroUpgrade python3-wheel-wheelUpgrade python3-scipyUpgrade python-pymongo-docUpgrade python3-sqlalchemyUpgrade python3-docsUpgrade python36Upgrade python3-pygmentsUpgrade python3-pymongo-gridfsUpgrade python-sqlalchemy-docUpgrade python3-bson | Dec 19, 2024 | Nov 24, 2024 |
| Debian | — | Upgrade python-virtualenv | May 15, 2025 | Nov 24, 2024 |
| Oracle_linux | — | Upgrade python3-pygmentsUpgrade python3-virtualenvUpgrade python3-pymongoUpgrade python36-debugUpgrade python-virtualenvUpgrade python3-wheel-wheelUpgrade python3-sqlalchemyUpgrade python3-bsonUpgrade python-nose-docsUpgrade python3-pymongo-gridfsUpgrade python3-noseUpgrade python3-PyMySQLUpgrade python36-develUpgrade python-pymongo-docUpgrade python3-wheelUpgrade python3-docsUpgrade python3-distroUpgrade python3-scipyUpgrade python3-docutilsUpgrade python-virtualenv-docUpgrade python36Upgrade python-sqlalchemy-docUpgrade python36-rpm-macros | Dec 13, 2024 | Nov 24, 2024 |
| Redhat_linux | — | Upgrade python-virtualenv | Feb 10, 2025 | Nov 24, 2024 |
| Rocky_linux | — | Upgrade python3-sqlalchemyUpgrade python3-bsonUpgrade python3-scipy-debuginfoUpgrade python3-pymongoUpgrade python36Upgrade python3-bson-debuginfoUpgrade python3-pymongo-debuginfoUpgrade python36-develUpgrade python3-pymongo-gridfsUpgrade python3-scipyUpgrade scipy-debugsourceUpgrade python36-debugUpgrade python-pymongo-debugsourceUpgrade python-pymongo-debuginfo | Feb 5, 2026 | Dec 19, 2024 |
| Ubuntu | — | Upgrade virtualenv (Ubuntu Pro)Upgrade python3-virtualenv (Ubuntu Pro) | Feb 20, 2025 | Nov 24, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub