CVE-2026-68939
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Pyenv prior to 2.8.0, is_version_safe() accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in several scripts pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version.
Risk Assessment
An attacker can substitute the Python version used by an application, potentially leading to unauthorized code execution or environment integrity compromise.
Recommendation
Update pyenv to version 2.8.0 or later and avoid using unquoted environment variables in scripts.
Original NVD description (English source)
Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0.