Unquoted Search Path or Element Affecting python package, versions [0,]
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (15th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-PYTHON-8281187
- published 23 Oct 2024
- disclosed 22 Oct 2024
- credit y5c4l3
Introduced: 22 Oct 2024
New CVE-2024-9287 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Unquoted Search Path or Element due to improper quoting of path names during the creation of virtual environments. An attacker can execute arbitrary commands when the virtual environment is activated by injecting commands into the activation scripts.
Note:
Virtual environments which are not created by an attacker or which aren't activated before being used (ie ./venv/bin/python) are not affected.
PoC
envname='";uname -a;"'
mkdir "$envname"
cd "$envname"
python3 -m venv .
. ./bin/activate