CVE-2026-68939: Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)
Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pyenvto a version that resolves this vulnerability.Fixed in 2.8.0Patch CVE-2022-35861
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of pyenv before 2.8.0 are exposed when a .python-version value contains shell glob metacharacters and pyenv runs in a directory containing attacker-controlled filenames that match the pattern. The result is silent selection of a different installed Python interpreter or version.
What does an attacker need to exploit it?
An attacker needs influence over the .python-version value and the ability to place or control a filename in the current working directory that matches its wildcard pattern. Exploitation relies on pathname expansion of the unquoted PYENV_VERSION value.
What should teams do if they cannot patch immediately?
Upgrade pyenv to version 2.8.0, which fixes the issue. If upgrading is not immediately possible, avoid using .python-version values containing glob or wildcard metacharacters and avoid running affected pyenv commands in directories with untrusted files.
How can I determine whether my environment may already be affected?
Review .python-version files for shell glob metacharacters and check whether the affected pyenv commands are being run from directories containing filenames that could match those patterns. Affected behavior can cause pyenv to choose a different installed interpreter or version than the literal value in .python-version.