PT-2024-9155 · Unknown+10 · Virtualenv+10

Musicinmybrain · Published 2024-09-23 · Updated 2026-03-17 · CVE-2024-53899

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: virtualenv versions prior to 20.26.6

Description: The issue is related to command injection through the activation scripts for a virtual environment in virtualenv. It is caused by the incorrect quoting of magic template strings when replacing, allowing an attacker to execute arbitrary commands. This can enable a remote attacker to perform unauthorized actions.

Recommendations: For versions prior to 20.26.6, upgrade to version 20.26.6 or later to resolve the issue. As a temporary workaround, consider disabling the activation scripts for virtual environments until a patch is available. Restrict access to the vulnerable activation scripts to minimize the risk of exploitation.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

ALSA-2024:10953

ALT-PU-2025-6288

AZL-53417

AZL-53645

BDU:2024-10842

BIT-VIRTUALENV-2024-53899

CESA-2024_10953

CVE-2024-53899

GHSA-RQC4-2HC7-8C8V

INFSA-2024_10953

OESA-2025-1241

OPENSUSE-SU-2024_4093-1

OPENSUSE-SU-2024_4143-1

OPENSUSE-SU-2025:15252-1

PYSEC-2024-187

RHSA-2024:10953

RHSA-2024:11048

RHSA-2024:11091

RHSA-2024:11093

RHSA-2024:11094

RHSA-2024_10953

RHSA-2025:0002

RLSA-2024:10953

SUSE-SU-2024:4093-1

SUSE-SU-2024:4143-1

SUSE-SU-2024_4093-1

SUSE-SU-2024_4143-1

USN-7271-1

USN-7271-2

Affected Products

Alt Linux

Almalinux

Centos

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Virtualenv

References · 53

• 🔥 https://github.com/pypa/virtualenv/issues/2768 · Exploit
• https://github.com/pypa/virtualenv/pull/2771 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-53899 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7271-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53899 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-187 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rqc4-2hc7-8c8v · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2024-10953.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-11048.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53899 · Security Note
• https://ubuntu.com/security/CVE-2024-53899 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-virtualenv-2024-53899 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4143-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10842 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-53899 · Security Note