https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:45:00 +0000 https://vulnerability.circl.lu/vuln/cve-2024-9287 <p><strong>Affected:</strong> Python Software Foundation CPython, python cpython</p> <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> <p><strong>Affected:</strong> Python Software Foundation CPython, python cpython</p> <p>A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment &#34;activation&#34; scripts (ie &#34;source venv/bin/activate&#34;). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie &#34;./venv/bin/python&#34;) are not affected.</p> https://vulnerability.circl.lu/vuln/cve-2024-9287 https://vulnerability.circl.lu/vuln/usn-7116-1 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: python3.8, Ubuntu:22.04:LTS: python3.10, Ubuntu:24.04:LTS: python3.12</p> <p>It was discovered that Python incorrectly handled quoting path names when using the venv module. A local attacker able to control virtual environments could possibly use this issue to execute arbitrary code when the virtual environment is activated.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: python3.8, Ubuntu:22.04:LTS: python3.10, Ubuntu:24.04:LTS: python3.12</p> <p>It was discovered that Python incorrectly handled quoting path names when using the venv module. A local attacker able to control virtual environments could possibly use this issue to execute arbitrary code when the virtual environment is activated.</p> https://vulnerability.circl.lu/vuln/usn-7116-1