CVE-2024-9287— Virtual environment (venv) activation scripts don't quote paths

Virtual environment (venv) activation scripts don't quote paths

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

N/A

未经引用的搜索路径或元素

Python 安全漏洞

Python是Python基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。 Python存在安全漏洞，该漏洞源于venv模块和CLI中发现一个漏洞，其中创建虚拟环境时提供的路径名未正确引用，允许创建者将命令注入虚拟环境激活脚本。

N/A

N/A