virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-nose-docsUpgrade python-virtualenv-docUpgrade python3-docutilsUpgrade python3-wheelUpgrade python36-develUpgrade python36-rpm-macrosUpgrade python36-debugUpgrade python3-virtualenvUpgrade python3-distroUpgrade python3-PyMySQLUpgrade python3-pymongoUpgrade python3-noseUpgrade python3-bsonUpgrade python-sqlalchemy-docUpgrade python3-docsUpgrade python36Upgrade python-pymongo-docUpgrade python3-scipyUpgrade python3-wheel-wheelUpgrade python3-sqlalchemyUpgrade python3-pymongo-gridfsUpgrade python3-pygments | Dec 19, 2024 | Nov 24, 2024 |
| Debian | — | No solution existsUpgrade python-virtualenv | May 15, 2025 | Nov 24, 2024 |
| Oracle_linux | — | Upgrade python36-debugUpgrade python-nose-docsUpgrade python3-pygmentsUpgrade python3-virtualenvUpgrade python3-bsonUpgrade python3-pymongoUpgrade python-virtualenvUpgrade python3-wheel-wheelUpgrade python3-sqlalchemyUpgrade python3-PyMySQLUpgrade python-sqlalchemy-docUpgrade python3-wheelUpgrade python3-pymongo-gridfsUpgrade python3-noseUpgrade python3-docsUpgrade python36-rpm-macrosUpgrade python3-distroUpgrade python3-scipyUpgrade python3-docutilsUpgrade python-virtualenv-docUpgrade python36Upgrade python-pymongo-docUpgrade python36-devel | Dec 13, 2024 | Nov 24, 2024 |
| Redhat_linux | — | Upgrade python-virtualenv | Feb 10, 2025 | Nov 24, 2024 |
| Rocky_linux | — | Upgrade python-pymongo-debuginfoUpgrade python36-develUpgrade python3-pymongo-debuginfoUpgrade scipy-debugsourceUpgrade python3-pymongo-gridfsUpgrade python36-debugUpgrade python3-scipyUpgrade python-pymongo-debugsourceUpgrade python3-bsonUpgrade python3-sqlalchemyUpgrade python3-pymongoUpgrade python36Upgrade python3-bson-debuginfoUpgrade python3-scipy-debuginfo | Feb 5, 2026 | Dec 19, 2024 |
| Ubuntu | — | Upgrade virtualenv (Ubuntu Pro)Upgrade python3-virtualenv (Ubuntu Pro) | Feb 20, 2025 | Nov 24, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub