CVE-2024-9287
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2024-9287. We'll provide specific mitigation strategies based on your environment and risk profile.
Description
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
Available Exploits
Related News
A vulnerability was identified in F5 Products. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system. Note: No patch is currently available for CVE-2024-9287 of the affected products. Hence, the risk l…
Affected Products
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Advisory provided by GitHub Security Advisory Database. Published: October 22, 2024, Modified: April 26, 2025