CVE-2024-9287
MediumSummary
In CPython, the venv module and CLI do not properly quote paths when creating a virtual environment, allowing injection of commands into activation scripts (e.g., source venv/bin/activate). This enables arbitrary code execution upon activation.
Risk Assessment
An attacker can inject malicious commands into activation scripts, which execute every time the virtual environment is activated, posing a serious system security risk.
Recommendation
Update CPython to a version that fixes path quoting in venv, and avoid creating virtual environments from untrusted paths.
Original NVD description (English source)
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-