PYSEC-2024-187: virtualenv fixed in 20.26.6

PYSEC-2024-187 PUBLISHED CVSS 9.800000190734863 CRITICAL

Record from OSV · Published November 24, 2024

virtualenv is fixed in 20.26.6 (PyPI)

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
virtualenv	PyPI	20.26.6

Risk scores

CVSS 3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
PyPI	virtualenv	20.0.0b1, 0.8, 0.8.1

Timeline

Nov 24, 2024 CVE Published
Jan 19, 2025 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln PYSEC-2024-187
vulnetix vdb fixes PYSEC-2024-187

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/PYSEC-2024-187/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →