virtualenv allows command injection through activation scripts for a virtual environment

🗓️ 24 Nov 2024 18:31:39Reported by GitHub Advisory DatabaseType

Virtualenv prior to version 20.26.6 is vulnerable to command injection via activation scripts.

Reporter	Title	Published	Views	Family All 107
IBM Security Bulletins	Security Bulletin: There is a vulnerability in the wheel package for the Virtualenv library affecting watsonx Code Assistant On Prem Extensions	27 Mar 202515:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to virtualenv-20.17.1-py3-none-any.whl CVE-2024-53899	13 Feb 202509:52	–	ibm
Tenable Nessus	Amazon Linux 2023 : python3-virtualenv (ALAS2023-2025-831)	5 Feb 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : python36:3.6 (ALSA-2024:10953)	19 Dec 202400:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: python-virtualenv (CVE-2024-53899)	20 Mar 202500:00	–	nessus
Tenable Nessus	Fedora 40 : uv (2024-075f626765)	7 Dec 202400:00	–	nessus
Tenable Nessus	Fedora 41 : uv (2024-8568f9cd5e)	7 Dec 202400:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: python-virtualenv (CVE-2024-53899)	20 Mar 202500:00	–	nessus
Tenable Nessus	MiracleLinux 8 : python36:3.6 (AXSA:2024-9397:01)	20 Jan 202600:00	–	nessus
Tenable Nessus	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.5)	31 Mar 202500:00	–	nessus

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-53899
github	www.github.com/pypa/virtualenv/issues/2768
github	www.github.com/pypa/virtualenv/pull/2771
github	www.github.com/pypa/virtualenv/releases/tag/20.26.6
github	www.github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2024-187.yaml
github	www.github.com/advisories/GHSA-rqc4-2hc7-8c8v

21 Jan 2025 17:59Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.8 - 8.4

EPSS0.00226

SSVC