CVE-2024-53899: Command Injection
Last updated 25 February 2025
Other sources
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/virtualenvto a version that resolves this vulnerability.Fixed in 20.26.6 - Upgrade
Upgrade
debian/python-virtualenvto a version that resolves this vulnerability.Fixed in 20.29.1+ds-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.26.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.25.0-3 - Upgrade
Upgrade
virtualenvto a version that resolves this vulnerability.Fixed in 20.26.6
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53899?
CVE-2024-53899 is classified as a command injection vulnerability, which can compromise the security of the system.
How do I fix CVE-2024-53899?
To fix CVE-2024-53899, update virtualenv to version 20.26.6 or later.
What software is affected by CVE-2024-53899?
CVE-2024-53899 affects virtualenv versions prior to 20.26.6.
What could happen if I don't resolve CVE-2024-53899?
If left unresolved, CVE-2024-53899 could allow an attacker to execute arbitrary commands on the system through manipulated activation scripts.
Is CVE-2024-53899 related to any other vulnerabilities?
CVE-2024-53899 is not the same as CVE-2024-9287, although both involve vulnerabilities in virtualenv.