CVE-2020-11073

2020-05-1319:15:11

Google

osv.dev

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.4%

JSON

In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious .venv file could run arbitrary code without any user interaction. This is fixed in version: 1.16.0

CPENameOperatorVersion
zsh-autoswitch-virtualenveq0.5.0
zsh-autoswitch-virtualenveq0.4.0
zsh-autoswitch-virtualenveq0.3.3
zsh-autoswitch-virtualenveq1.15.0
zsh-autoswitch-virtualenveq1.8.1
zsh-autoswitch-virtualenveq1.14.0
zsh-autoswitch-virtualenveq0.2.1
zsh-autoswitch-virtualenveq0.3.0
zsh-autoswitch-virtualenveq0.5.1
zsh-autoswitch-virtualenveq1.5.0

Name	Operator	Version
zsh-autoswitch-virtualenv	eq	0.5.0
zsh-autoswitch-virtualenv	eq	0.4.0
zsh-autoswitch-virtualenv	eq	0.3.3
zsh-autoswitch-virtualenv	eq	1.15.0
zsh-autoswitch-virtualenv	eq	1.8.1
zsh-autoswitch-virtualenv	eq	1.14.0
zsh-autoswitch-virtualenv	eq	0.2.1
zsh-autoswitch-virtualenv	eq	0.3.0
zsh-autoswitch-virtualenv	eq	0.5.1
zsh-autoswitch-virtualenv	eq	1.5.0