Skip to content
Appaloosa Scout

Vulnerability · NVD

CVE-2024-9287

MEDIUM 7.8 Vendor bulletin scale — NVD CVSS pending

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

Attack vector : Local No user interaction
Show raw CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS 0.65% exploit very unlikely percentile 47.7%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

  • Python 3.12 Windows winget:Python.Python.3.12
    Affected — Fixed in — Latest tracked 3.12.10 undetermined
Vulnerable CPE configurations (6)
Vendor Product Versions
python python
All platforms (wildcard)
 <3.9.21
python python
All platforms (wildcard)
 ≥3.10.0 <3.10.16
python python
All platforms (wildcard)
 ≥3.11.0 <3.11.11
python python
All platforms (wildcard)
 ≥3.12.0 <3.12.8
python python
All platforms (wildcard)
 ≥3.13.0 <3.13.1
python python
All platforms (wildcard)
 —
View on NVD ↗ Advisory · mail.python.org Advisory · github.com