AIKIDO-2024-10371
virtualenv is vulnerable to Command Injection
54
Medium Risk
This Affects:
virtualenvTL;DR
Affected versions of this package are vulnerable to command injection due to improperly quoted string placeholders in activation scripts via the ViaTemplateActivator class. The vulnerability arises in several shell activation scripts that use placeholders like __VIRTUAL_ENV__ without proper sanitization or quoting, allowing attackers to inject arbitrary commands into the execution flow.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
virtualenv is vulnerable to Command Injection in versions 0.0.1 - 20.26.5.
How to fix this
Upgrade the virtualenv library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant