virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-virtualenv-docUpgrade python-nose-docsUpgrade python36-develUpgrade python36-debugUpgrade python3-wheelUpgrade python3-docutilsUpgrade python3-distroUpgrade python3-virtualenvUpgrade python3-PyMySQLUpgrade python3-noseUpgrade python36-rpm-macrosUpgrade python3-pymongoUpgrade python3-sqlalchemyUpgrade python3-pygmentsUpgrade python3-pymongo-gridfsUpgrade python3-bsonUpgrade python-pymongo-docUpgrade python36Upgrade python3-scipyUpgrade python-sqlalchemy-docUpgrade python3-wheel-wheelUpgrade python3-docs | Dec 19, 2024 | Nov 24, 2024 |
| Debian | — | Upgrade python-virtualenv | May 15, 2025 | Nov 24, 2024 |
| Oracle_linux | — | Upgrade python3-sqlalchemyUpgrade python3-bsonUpgrade python3-pygmentsUpgrade python3-virtualenvUpgrade python3-wheel-wheelUpgrade python-virtualenvUpgrade python-nose-docsUpgrade python36-debugUpgrade python3-pymongoUpgrade python3-noseUpgrade python-sqlalchemy-docUpgrade python3-wheelUpgrade python-pymongo-docUpgrade python36-develUpgrade python36Upgrade python3-scipyUpgrade python3-docutilsUpgrade python-virtualenv-docUpgrade python3-PyMySQLUpgrade python3-distroUpgrade python36-rpm-macrosUpgrade python3-pymongo-gridfsUpgrade python3-docs | Dec 13, 2024 | Nov 24, 2024 |
| Redhat_linux | — | Upgrade python-virtualenv | Feb 10, 2025 | Nov 24, 2024 |
| Rocky_linux | — | Upgrade scipy-debugsourceUpgrade python3-pymongo-gridfsUpgrade python-pymongo-debuginfoUpgrade python-pymongo-debugsourceUpgrade python36-develUpgrade python36-debugUpgrade python3-scipyUpgrade python3-pymongo-debuginfoUpgrade python3-scipy-debuginfoUpgrade python3-sqlalchemyUpgrade python3-pymongoUpgrade python3-bsonUpgrade python36Upgrade python3-bson-debuginfo | Feb 5, 2026 | Dec 19, 2024 |
| Ubuntu | — | Upgrade virtualenv (Ubuntu Pro)Upgrade python3-virtualenv (Ubuntu Pro) | Feb 20, 2025 | Nov 24, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub