{"id":"CVE-2024-53899","title":"virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)","summary":"A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,int…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-78","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","affected":["openshift_lightspeed","enterprise_linux_server_v_7_els","openshift_dev_spaces 3","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_2","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_e4s_v_8_4","enterprise_linux_appstream_tus_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_eus_v_8_8"],"patched":["enterprise_linux_server_v_7_els","openshift_dev_spaces 3","enterprise_linux_appstream_v_8","enterprise_linux_appstream_aus_v_8_2","enterprise_linux_appstream_aus_v_8_4","enterprise_linux_appstream_e4s_v_8_4","enterprise_linux_appstream_tus_v_8_4","enterprise_linux_appstream_aus_v_8_6","enterprise_linux_appstream_e4s_v_8_6","enterprise_linux_appstream_tus_v_8_6","enterprise_linux_appstream_eus_v_8_8"],"published":"2024-11-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:08:39+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53899.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53899.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-53899"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2328554"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53899"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53899"},{"url":"https://github.com/pypa/virtualenv/issues/2768"},{"url":"https://github.com/pypa/virtualenv/pull/2771"},{"url":"https://github.com/pypa/virtualenv/releases/tag/20.26.6"},{"url":"https://access.redhat.com/errata/RHSA-2024:11048"},{"url":"https://access.redhat.com/errata/RHSA-2025:0892"},{"url":"https://access.redhat.com/errata/RHSA-2024:10953"},{"url":"https://access.redhat.com/errata/RHSA-2024:11091"},{"url":"https://access.redhat.com/errata/RHSA-2025:0002"},{"url":"https://access.redhat.com/errata/RHSA-2024:11094"},{"url":"https://access.redhat.com/errata/RHSA-2024:11093"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2024-187.yaml"},{"url":"https://github.com/pypa/virtualenv"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.01572,"epssPercentile":0.75271,"aliases":["GHSA-rqc4-2hc7-8c8v","BIT-virtualenv-2024-53899","PYSEC-2024-187"],"ecosystem":"pip","scores":{"vendor":7.8,"osv":8.4},"ingestedAt":"2026-09-12T03:13:01.726Z","slug":"CVE-2024-53899","body":"## Overview\n\nA flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system.\n\n## Vendor advisories\n\n- **RHSA-2024:11048** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11048)\n- **RHSA-2025:0892** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3 · released 2025-02-03 · [advisory](https://access.redhat.com/errata/RHSA-2025:0892)\n- **RHSA-2024:10953** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2024:10953)\n- **RHSA-2024:11091** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11091)\n- **RHSA-2025:0002** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4) · released 2025-01-01 · [advisory](https://access.redhat.com/errata/RHSA-2025:0002)\n- **RHSA-2024:11094** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11094)\n- **RHSA-2024:11093** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.8) · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11093)\n- **Red Hat VEX** · Important · affected: OpenShift Lightspeed · no fix planned: OpenShift Lightspeed · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53899.json)\n\n**virtualenv: potential command injection via virtual environment activation scripts** — rated Important by Red Hat. Released 2024-11-24, updated 2026-10-15.\n\nAffected:\n\n- OpenShift Lightspeed\n\nFixed:\n\n- Red Hat Enterprise Linux Server (v. 7 ELS)\n- Red Hat OpenShift Dev Spaces 3\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream AUS (v. 8.2)\n- Red Hat Enterprise Linux AppStream AUS (v.8.4)\n- Red Hat Enterprise Linux AppStream E4S (v.8.4)\n- Red Hat Enterprise Linux AppStream TUS (v.8.4)\n- Red Hat Enterprise Linux AppStream AUS (v.8.6)\n- Red Hat Enterprise Linux AppStream E4S (v.8.6)\n- Red Hat Enterprise Linux AppStream TUS (v.8.6)\n- Red Hat Enterprise Linux AppStream EUS (v.8.8)\n\nNo fix planned:\n\n- OpenShift Lightspeed\n\nNot affected:\n\n- Red Hat OpenShift Dev Spaces 3\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:11048\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:0892\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:10953\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2024-53899)\n\nAffected packages:\n\n- `virtualenv < 20.26.6`\n\nPatched in:\n\n- `virtualenv 20.26.6`\n\nSource: https://osv.dev/vulnerability/GHSA-rqc4-2hc7-8c8v","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[{"seq":222225,"id":"CVE-2024-53899","ts":1792065097284,"field":"cvss","old":"8.4","new":"7.8"}]}