CVE-2024-53899: virtualenv allows command injection through activation scripts for a virtual environment

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-11-24 · updated 2026-06-17
Weakness: CWE-77

Description

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Affected products

pypa virtualenv: before 20.26.6 — fixed in 20.26.6
Pypi Virtualenv: before 20.26.6; 0.8, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.9 (+216) — fixed in 20.26.6

How to fix

Upgrade to a fixed version: pypa virtualenv 20.26.6; Pypi Virtualenv 20.26.6. Check the vendor advisory for mitigations.

References

https://github.com/pypa/virtualenv/issues/2768
https://github.com/pypa/virtualenv/pull/2771
https://github.com/pypa/virtualenv/releases/tag/20.26.6

Get alerted when CVE-2024-53899 or the next vulnerability affects your stack