Skip to content

[CVE-2024-9287] venv activation scripts do not quote strings properly #124651

Closed
@y5c4l3

Description

@y5c4l3

Bug report

Bug description:

Crafted paths break the script templates:

envname='";uname -a;"'
mkdir "$envname"
cd "$envname"
python3 -m venv .
. ./bin/activate
Linux archlinux 6.10.6-arch1-1 #1 SMP PREEMPT_DYNAMIC Mon, 19 Aug 2024 17:02:39 +0000 x86_64 GNU/Linux

Like pypa/virtualenv#2768 the execution path itself is low-risk, but it enables many potential downstream attack vectors. Downstream projects that automatically initialize and activate venv at a controllable path (e.g. read from repo configuration file) could execute unexpected commands.

CPython versions tested on:

3.8, 3.9, 3.10, 3.11, 3.12, 3.13, CPython main branch

Operating systems tested on:

Linux

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.10only security fixes3.11only security fixes3.12only security fixes3.13bugs and security fixes3.14bugs and security fixes3.9only security fixestopic-venvRelated to the venv moduletype-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions