Skip to content
Fencer Vulns
high 8.4

CVE-2024-53899 json

virtualenv allows command injection through activation scripts for a virtual environment

published 2024-11-24 23 mo ago modified 2026-09-10 1 mo ago also BIT-virtualenv-2024-53899 , EUVD-2024-0172 , GHSA-rqc4-2hc7-8c8v , PYSEC-2024-187

cvss
8.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Patch / fix

  • pypi virtualenv 20.26.6
  • bitnami virtualenv 20.26.6
  • virtualenv virtualenv 20.26.6
  • python-virtualenv Debian 14, Debian 13 20.26.6+ds-1

debian advisories DEBIAN-CVE-2024-53899

  • python-virtualenv Ubuntu Pro 22.04 LTS 20.13.0+ds-2ubuntu0.1~esm1
  • python-virtualenv Ubuntu Pro 24.04 LTS 20.25.0+ds-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2024-53899

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • scipy RHEL 8 1.0.0-21.module+el8.10.0+20784+edafcd43
  • python36 RHEL 8 3.6.8-39.module+el8.10.0+20784+edafcd43
  • python-nose RHEL 8 1.3.7-31.module+el8.10.0+20784+edafcd43
  • python-wheel RHEL 8 1:0.31.1-3.module+el8.10.0+20784+edafcd43
  • python3-bson RHEL 8 3.7.0-1.module+el8.10.0+20784+edafcd43
  • python3-nose RHEL 8 1.3.7-31.module+el8.10.0+20784+edafcd43
  • python-distro RHEL 8 1.4.0-2.module+el8.10.0+20784+edafcd43
  • python3-scipy RHEL 8 1.0.0-21.module+el8.10.0+20784+edafcd43

red hat advisories RHSA-2025:0002RHSA-2024:11094RHSA-2024:11093RHSA-2024:11048RHSA-2024:11091RHSA-2024:10953

  • python3-virtualenv SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 20.17.1-150600.3.5.1
  • python-virtualenv SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Python 3 15 SP6 +5 more 20.22.0-150400.9.6.1

suse advisories SUSE-SU-2024:4143-1SUSE-SU-2024:4093-1

  • oci-cli openSUSE Tumbleweed 3.61.0-1.1

opensuse advisories openSUSE-SU-2025:15252-1

  • python36 AlmaLinux 8 3.6.8-39.module_el8.10.0+3769+3838165b
  • python3-bson AlmaLinux 8 3.7.0-1.module_el8.9.0+3700+efebe9fd
  • python3-nose AlmaLinux 8 1.3.7-31.module_el8.9.0+3700+efebe9fd
  • python3-scipy AlmaLinux 8 1.0.0-21.module_el8.9.0+3700+efebe9fd
  • python3-wheel AlmaLinux 8 1:0.31.1-3.module_el8.9.0+3700+efebe9fd
  • python3-distro AlmaLinux 8 1.4.0-2.module_el8.9.0+3700+efebe9fd
  • python3-pymongo AlmaLinux 8 3.7.0-1.module_el8.9.0+3700+efebe9fd
  • python3-PyMySQL AlmaLinux 8 0.10.1-2.module_el8.9.0+3700+efebe9fd

almalinux advisories ALSA-2024:10953

  • scipy Rocky Linux 8 1.0.0-21.module+el8.10.0+1592+61442852
  • python36 Rocky Linux 8 3.6.8-39.module+el8.10.0+1592+61442852
  • python-nose Rocky Linux 8 1.3.7-31.module+el8.10.0+1592+61442852
  • python-wheel Rocky Linux 8 1:0.31.1-3.module+el8.10.0+1592+61442852
  • python-distro Rocky Linux 8 1.4.0-2.module+el8.10.0+1592+61442852
  • python-pymongo Rocky Linux 8 3.7.0-1.module+el8.10.0+1592+61442852
  • python-PyMySQL Rocky Linux 8 0.10.1-2.module+el8.10.0+1582+bc278001
  • python-docutils Rocky Linux 8 0.14-12.module+el8.10.0+1592+61442852

rocky linux advisories RLSA-2024:10953

  • python-virtualenv Azure Linux 3.0 20.25.0-3
  • python-virtualenv CBL-Mariner 2.0 20.26.6-1

azure linux advisories AZL-53417AZL-53645

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-53899 updated cvss 7.8

virtualenv: potential command injection via virtual environment activation scripts

  • Red Hat OpenShift Lightspeed lightspeed-service-api-rhel9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) scipy 1.0.0-21.module+el8.10.0+20784+edafcd43, python36 3.6.8-39.module+el8.10.0+20784+edafcd43, python-nose 1.3.7-31.module+el8.10.0+20784+edafcd43, python3-bson 3.7.0-1.module+el8.10.0+20784+edafcd43, python-distro 1.4.0-2.module+el8.10.0+20784+edafcd43, python-wheel 0.31.1-3.module+el8.10.0+20784+edafcd43, +19 more
    fixed: vendor fix RHSA-2024:10953
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) scipy 1.0.0-20.module+el8.1.0+3334+5cb623d7, python36 3.6.8-2.module+el8.1.0+3334+5cb623d7, python-nose 1.3.7-30.module+el8.1.0+3334+5cb623d7, python-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, python-wheel 0.31.1-2.module+el8.1.0+3724+3c097090, python3-bson 3.6.1-11.module+el8.1.0+3334+5cb623d7, +19 more
    fixed: vendor fix RHSA-2024:11091
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) scipy 1.0.0-20.module+el8.1.0+3334+5cb623d7, python36 3.6.8-2.module+el8.4.0+15040+36b018e7.1, python3-bson 3.7.0-1.module+el8.4.0+9670+1849b5f9, python-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, python-pymongo 3.7.0-1.module+el8.4.0+9670+1849b5f9, python3-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, +19 more
    fixed: vendor fix RHSA-2025:0002
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) scipy 1.0.0-21.module+el8.5.0+10916+41bd434d, python36 3.6.8-38.module+el8.5.0+12207+5c5719bc, python3-bson 3.7.0-1.module+el8.4.0+9670+1849b5f9, python-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, python-nose 1.3.7-31.module+el8.5.0+12207+5c5719bc, python-pymongo 3.7.0-1.module+el8.4.0+9670+1849b5f9, +19 more
    fixed: vendor fix RHSA-2024:11094
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) scipy 1.0.0-20.module+el8.1.0+3334+5cb623d7, python36 3.6.8-2.module+el8.4.0+15040+36b018e7.1, python3-bson 3.7.0-1.module+el8.4.0+9670+1849b5f9, python-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, python-pymongo 3.7.0-1.module+el8.4.0+9670+1849b5f9, python3-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, +19 more
    fixed: vendor fix RHSA-2025:0002
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) scipy 1.0.0-21.module+el8.5.0+10916+41bd434d, python36 3.6.8-38.module+el8.5.0+12207+5c5719bc, python3-bson 3.7.0-1.module+el8.4.0+9670+1849b5f9, python-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, python-nose 1.3.7-31.module+el8.5.0+12207+5c5719bc, python-pymongo 3.7.0-1.module+el8.4.0+9670+1849b5f9, +19 more
    fixed: vendor fix RHSA-2024:11094
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) scipy 1.0.0-21.module+el8.5.0+10916+41bd434d, python36 3.6.8-38.module+el8.5.0+12207+5c5719bc, python3-bson 3.7.0-1.module+el8.4.0+9670+1849b5f9, python-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, python-nose 1.3.7-31.module+el8.5.0+12207+5c5719bc, python-pymongo 3.7.0-1.module+el8.4.0+9670+1849b5f9, +19 more
    fixed: vendor fix RHSA-2024:11093
show 5 more
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) scipy 1.0.0-20.module+el8.1.0+3334+5cb623d7, python36 3.6.8-2.module+el8.4.0+15040+36b018e7.1, python3-bson 3.7.0-1.module+el8.4.0+9670+1849b5f9, python-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, python-pymongo 3.7.0-1.module+el8.4.0+9670+1849b5f9, python3-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, +19 more
    fixed: vendor fix RHSA-2025:0002
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) scipy 1.0.0-21.module+el8.5.0+10916+41bd434d, python36 3.6.8-38.module+el8.5.0+12207+5c5719bc, python3-bson 3.7.0-1.module+el8.4.0+9670+1849b5f9, python-distro 1.4.0-2.module+el8.1.0+3334+5cb623d7, python-nose 1.3.7-31.module+el8.5.0+12207+5c5719bc, python-pymongo 3.7.0-1.module+el8.4.0+9670+1849b5f9, +19 more
    fixed: vendor fix RHSA-2024:11094
  • Red Hat Enterprise Linux Server (v. 7 ELS) python-virtualenv 15.1.0-7.el7_9.1
    fixed: vendor fix RHSA-2024:11048
  • Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel9 3.18-1
    fixed: vendor fix RHSA-2025:0892
  • Red Hat OpenShift Container Platform 4 python-virtualenv Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8 Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel9 3.18-6, devspaces/server-rhel9 3.18-2, devspaces/traefik-rhel9 3.18-1, devspaces/configbump-rhel9 3.18-1, devspaces/dashboard-rhel9 3.18-10, devspaces/imagepuller-rhel9 3.18-1, +5 more Red Hat Satellite 6 python-virtualenv
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
23 mo ago

Exploit prediction

1.57% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/pypa/virtualenv/issues/2768 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi virtualenv
<20.26.6
20.26.6
bitnami virtualenv
<20.26.6
20.26.6

Affected products

  • virtualenv virtualenv

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.