CVE-2024-53899: virtualenv Command Injection

CVSS: 8.4v3.1HighAnalyzed

AliasesSUSE-SU-2024:4093-1SUSE-SU-2024:4143-1GHSA-rqc4-2hc7-8c8v+21 more

Published 24-11-2024Last modified 24-11-2024

Vulnerability summary

CVE-2024-53899 is a high (CVSS 8.4) Command Injection vulnerability in virtualenv. EPSS estimates a 1.57% chance of exploitation in the next 30 days, higher than 75% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

44/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.4/10

010

High · v3.1 (CVE.org)

EPSS score

1.57%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-HWHG-WR6C-6RJ8

Timeline

24-11-2024
PublishedVulnerability first disclosed.
24-11-2024
Last modifiedVulnerability information updated.

Description

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

CVSS metrics

8 scores · 8 sources · 1 version

v3.18.4

EPSS trend

Probability

1.57%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

0.00 pp

From 1.57% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.57%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

githubUnverified
Virtualenv
Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat39 products

python-distro< 0:1.4.0-2.module+el8.10.0+20784+edafcd43 | < 0:1.4.0-2.module+el8.1.0+3334+5cb623d7
python-docs< 0:3.6.7-2.module+el8.10.0+20784+edafcd43 | < 0:3.6.7-2.module+el8.1.0+3334+5cb623d7
python-docutils< 0:0.14-12.module+el8.10.0+20784+edafcd43 | < 0:0.14-12.module+el8.1.0+3334+5cb623d7
python-nose< 0:1.3.7-31.module+el8.10.0+20784+edafcd43 | < 0:1.3.7-30.module+el8.1.0+3334+5cb623d7 | < 0:1.3.7-31.module+el8.5.0+12207+5c5719bc | < 0:1.3.7-30.module+el8.4.0+15040+36b018e7.1
python-nose-docs< 0:1.3.7-31.module+el8.10.0+20784+edafcd43 | < 0:1.3.7-30.module+el8.1.0+3334+5cb623d7 | < 0:1.3.7-31.module+el8.5.0+12207+5c5719bc | < 0:1.3.7-30.module+el8.4.0+15040+36b018e7.1

python-pygments< 0:2.2.0-22.module+el8.10.0+20784+edafcd43 | < 0:2.2.0-20.module+el8.1.0+3334+5cb623d7 | < 0:2.2.0-22.module+el8.5.0+10789+e4939b94
python-pymongo< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python-pymongo-debuginfo< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python-pymongo-debugsource< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python-pymongo-doc< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python-PyMySQL< 0:0.10.1-2.module+el8.10.0+20784+edafcd43 | < 0:0.8.0-10.module+el8.1.0+3334+5cb623d7 | < 0:0.10.1-2.module+el8.4.0+9657+a4b6a102
python-sqlalchemy< 0:1.3.2-3.module+el8.10.0+20981+3704b446 | < 0:1.3.2-1.module+el8.1.0+3334+5cb623d7 | < 0:1.3.2-2.module+el8.8.0+20977+39d98680.1 | < 0:1.3.2-2.module+el8.6.0+20978+2ad18ee0.1 | < 0:1.3.2-2.module+el8.4.0+20979+8ba06d83.1
python-sqlalchemy-doc< 0:1.3.2-3.module+el8.10.0+20981+3704b446 | < 0:1.3.2-1.module+el8.1.0+3334+5cb623d7 | < 0:1.3.2-2.module+el8.8.0+20977+39d98680.1 | < 0:1.3.2-2.module+el8.6.0+20978+2ad18ee0.1 | < 0:1.3.2-2.module+el8.4.0+20979+8ba06d83.1
python-virtualenv< 0:15.1.0-23.module+el8.10.0+22619+61b70790 | < 0:15.1.0-7.el7_9.1 | < 0:15.1.0-19.module+el8.2.0+22651+db2d74c8.2 | < 0:15.1.0-22.module+el8.8.0+22625+4a966c0c.1 | < 0:15.1.0-21.module+el8.6.0+22648+901a012d.2 | < 0:15.1.0-19.module+el8.4.0+22650+01781d50.3
python-virtualenv-doc< 0:15.1.0-23.module+el8.10.0+22619+61b70790 | < 0:15.1.0-19.module+el8.2.0+22651+db2d74c8.2 | < 0:15.1.0-22.module+el8.8.0+22625+4a966c0c.1 | < 0:15.1.0-21.module+el8.6.0+22648+901a012d.2 | < 0:15.1.0-19.module+el8.4.0+22650+01781d50.3
python-wheel< 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | < 1:0.31.1-2.module+el8.1.0+3724+3c097090 | < 1:0.31.1-3.module+el8.5.0+12207+5c5719bc | < 1:0.31.1-2.module+el8.4.0+15040+36b018e7.1
python3-bson< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python3-bson-debuginfo< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python3-distro< 0:1.4.0-2.module+el8.10.0+20784+edafcd43 | < 0:1.4.0-2.module+el8.1.0+3334+5cb623d7
python3-docs< 0:3.6.7-2.module+el8.10.0+20784+edafcd43 | < 0:3.6.7-2.module+el8.1.0+3334+5cb623d7
python3-docutils< 0:0.14-12.module+el8.10.0+20784+edafcd43 | < 0:0.14-12.module+el8.1.0+3334+5cb623d7
python3-nose< 0:1.3.7-31.module+el8.10.0+20784+edafcd43 | < 0:1.3.7-30.module+el8.1.0+3334+5cb623d7 | < 0:1.3.7-31.module+el8.5.0+12207+5c5719bc | < 0:1.3.7-30.module+el8.4.0+15040+36b018e7.1
python3-pygments< 0:2.2.0-22.module+el8.10.0+20784+edafcd43 | < 0:2.2.0-20.module+el8.1.0+3334+5cb623d7 | < 0:2.2.0-22.module+el8.5.0+10789+e4939b94
python3-pymongo< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python3-pymongo-debuginfo< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python3-pymongo-gridfs< 0:3.7.0-1.module+el8.10.0+20784+edafcd43 | < 0:3.6.1-11.module+el8.1.0+3334+5cb623d7 | < 0:3.7.0-1.module+el8.4.0+9670+1849b5f9
python3-PyMySQL< 0:0.10.1-2.module+el8.10.0+20784+edafcd43 | < 0:0.8.0-10.module+el8.1.0+3334+5cb623d7 | < 0:0.10.1-2.module+el8.4.0+9657+a4b6a102
python3-scipy< 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | < 0:1.0.0-20.module+el8.1.0+3334+5cb623d7 | < 0:1.0.0-21.module+el8.5.0+10916+41bd434d
python3-scipy-debuginfo< 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | < 0:1.0.0-20.module+el8.1.0+3334+5cb623d7 | < 0:1.0.0-21.module+el8.5.0+10916+41bd434d
python3-sqlalchemy< 0:1.3.2-3.module+el8.10.0+20981+3704b446 | < 0:1.3.2-1.module+el8.1.0+3334+5cb623d7 | < 0:1.3.2-2.module+el8.8.0+20977+39d98680.1 | < 0:1.3.2-2.module+el8.6.0+20978+2ad18ee0.1 | < 0:1.3.2-2.module+el8.4.0+20979+8ba06d83.1
python3-virtualenv< 0:15.1.0-23.module+el8.10.0+22619+61b70790 | < 0:15.1.0-19.module+el8.2.0+22651+db2d74c8.2 | < 0:15.1.0-22.module+el8.8.0+22625+4a966c0c.1 | < 0:15.1.0-21.module+el8.6.0+22648+901a012d.2 | < 0:15.1.0-19.module+el8.4.0+22650+01781d50.3
python3-wheel< 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | < 1:0.31.1-2.module+el8.1.0+3724+3c097090 | < 1:0.31.1-3.module+el8.5.0+12207+5c5719bc | < 1:0.31.1-2.module+el8.4.0+15040+36b018e7.1
python3-wheel-wheel< 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | < 1:0.31.1-2.module+el8.1.0+3724+3c097090 | < 1:0.31.1-3.module+el8.5.0+12207+5c5719bc | < 1:0.31.1-2.module+el8.4.0+15040+36b018e7.1
python36< 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | < 0:3.6.8-2.module+el8.1.0+3334+5cb623d7 | < 0:3.6.8-38.module+el8.5.0+12207+5c5719bc | < 0:3.6.8-2.module+el8.4.0+15040+36b018e7.1
python36-debug< 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | < 0:3.6.8-2.module+el8.1.0+3334+5cb623d7 | < 0:3.6.8-38.module+el8.5.0+12207+5c5719bc | < 0:3.6.8-2.module+el8.4.0+15040+36b018e7.1
python36-devel< 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | < 0:3.6.8-2.module+el8.1.0+3334+5cb623d7 | < 0:3.6.8-38.module+el8.5.0+12207+5c5719bc | < 0:3.6.8-2.module+el8.4.0+15040+36b018e7.1
python36-rpm-macros< 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | < 0:3.6.8-2.module+el8.1.0+3334+5cb623d7 | < 0:3.6.8-38.module+el8.5.0+12207+5c5719bc | < 0:3.6.8-2.module+el8.4.0+15040+36b018e7.1
scipy< 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | < 0:1.0.0-20.module+el8.1.0+3334+5cb623d7 | < 0:1.0.0-21.module+el8.5.0+10916+41bd434d
scipy-debugsource< 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | < 0:1.0.0-20.module+el8.1.0+3334+5cb623d7 | < 0:1.0.0-21.module+el8.5.0+10916+41bd434d

Show all 39

Suse7 products

python-virtualenv&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 20.22.0-150400.9.6.1
python-virtualenv&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 20.22.0-150400.9.6.1
python-virtualenv&distro=SUSE Linux Enterprise Module for Python 3 15 SP5< 20.22.0-150400.9.6.1
python-virtualenv&distro=SUSE Linux Enterprise Module for Python 3 15 SP6< 20.22.0-150400.9.6.1
python-virtualenv&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 20.22.0-150400.9.6.1

Show all 7

Chainguard4 products

py3-cassandra-medusa< 0.23.0-r0
py3-cassandra-medusa-compat< 0.23.0-r0
request-1276< 0.23.0-r0
request-1276-compat< 0.23.0-r0

Opensuse4 products

oci-cli&distro=openSUSE Tumbleweed< 3.61.0-1.1
python-virtualenv&distro=openSUSE Leap 15.5< 20.22.0-150400.9.6.1
python-virtualenv&distro=openSUSE Leap 15.6< 20.22.0-150400.9.6.1
python3-virtualenv&distro=openSUSE Leap 15.6< 20.17.1-150600.3.5.1

Wolfi2 products

py3-cassandra-medusa< 0.23.0-r0
py3-cassandra-medusa-compat< 0.23.0-r0

Debian1 product

python-virtualenvAll versions (No fix recorded) | < 20.26.6+ds-1

PyPI1 product

virtualenv< 20.26.6

Ubuntu1 product

python-virtualenvAll versions (No fix recorded) | < 20.0.17-1ubuntu0.4+esm1 | < 20.13.0+ds-2ubuntu0.1~esm1 | < 20.25.0+ds-2ubuntu0.1~esm1

Virtualenv1 product

virtualenv< 20.26.6

9 vendors · 60 products

References

33 links

github.com/pypa/virtualenv/issues/2768WEBEVIDENCEARTICLEREPORTExploit
github.com/pypa/virtualenv/releases/tag/20.26.6WEBARTICLEREPORTRelease Notes
github.com/pypa/virtualenv/pull/2771WEBFIXARTICLEREPORTPatch
www.suse.com/support/update/announcement/2024/suse-su-20244093-1/Advisory
bugzilla.suse.com/1233706REPORT
www.suse.com/security/cve/CVE-2024-53899WEB
www.suse.com/support/update/announcement/2024/suse-su-20244143-1/Advisory
bugzilla.suse.com/1232072REPORT
nvd.nist.gov/vuln/detail/CVE-2024-53899AdvisoryOval
github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2024-187.yamlWEB

Show all 33 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities