CVE-2024-53899
published 2024-11-24CVE-2024-53899: virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly…
PriorityP345high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
1.57%
75.2th percentile
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-virtualenv | < python-virtualenv 20.26.6+ds-1 (forky) | python-virtualenv 20.26.6+ds-1 (forky) |
| msrc | azl3_python-virtualenv_20.25.0-3_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python-virtualenv_20.14.0-6_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-virtualenv_20.26.6-1_on_cbl_mariner_2.0 | — | — |
| virtualenv | virtualenv | < 20.26.6 | 20.26.6 |
| virtualenv | virtualenv | >= 0 < 20.26.6 | 20.26.6 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa5.3MEDIUM
osv7.8HIGH
vendor_msrc8.4HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
virtualenv allows command injection through activation scripts for a virtual environment
osv·2024-11-24·CVSS 5.3
CVE-2024-53899 [MEDIUM] virtualenv allows command injection through activation scripts for a virtual environment
virtualenv allows command injection through activation scripts for a virtual environment
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
GHSA
virtualenv allows command injection through activation scripts for a virtual environment
ghsa·2024-11-24·CVSS 5.3
CVE-2024-53899 [MEDIUM] CWE-77 virtualenv allows command injection through activation scripts for a virtual environment
virtualenv allows command injection through activation scripts for a virtual environment
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
OSV
CVE-2024-53899: virtualenv before 20
osv·2024-11-24·CVSS 7.8
CVE-2024-53899 [HIGH] CVE-2024-53899: virtualenv before 20
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
Ubuntu
virtualenv vulnerability
vendor_ubuntu·2025-02-25
CVE-2024-53899 virtualenv vulnerability
Title: virtualenv vulnerability
Summary: virtualenv could be made to crash or run programs as your login if it
opened a specially crafted file.
USN-7271-1 fixed a vulnerability in virtualenv. This update provides the
corresponding updates for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that virtualenv incorrectly handled paths when
activating virtual environments. An attacker could possibly use this issue
to execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
virtualenv vulnerability
vendor_ubuntu·2025-02-18
CVE-2024-53899 virtualenv vulnerability
Title: virtualenv vulnerability
Summary: python-virtualenv could be made to crash or run programs as your login if it
opened a specially crafted file.
It was discovered that virtualenv incorrectly handled paths when activating
virtual environments. An attacker could possibly use this issue to execute
arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
virtualenv: potential command injection via virtual environment activation scripts
vendor_redhat·2024-11-24·CVSS 7.8
CVE-2024-53899 [HIGH] CWE-78 virtualenv: potential command injection via virtual environment activation scripts
virtualenv: potential command injection via virtual environment activation scripts
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread insta
Microsoft
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same
vendor_msrc·2024-11-12·CVSS 8.4
CVE-2024-53899 [HIGH] CWE-77 virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, w
Debian
CVE-2024-53899: python-virtualenv - virtualenv before 20.26.6 allows command injection through the activation script...
vendor_debian·2024·CVSS 7.8
CVE-2024-53899 [HIGH] CVE-2024-53899: python-virtualenv - virtualenv before 20.26.6 allows command injection through the activation script...
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 20.26.6+ds-1)
sid: resolved (fixed in 20.26.6+ds-1)
trixie: resolved (fixed in 20.26.6+ds-1)
No detection rules found.
No public exploits indexed.
2024-11-24
Published