--- id: CVE-2024-53899 title: >- virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899) summary: >- A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,int… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cvssSource: vendor cwe: CWE-78 vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 8) affected: - openshift_lightspeed - enterprise_linux_server_v_7_els - openshift_dev_spaces 3 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_2 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_e4s_v_8_4 - enterprise_linux_appstream_tus_v_8_4 - enterprise_linux_appstream_aus_v_8_6 - enterprise_linux_appstream_e4s_v_8_6 - enterprise_linux_appstream_tus_v_8_6 - enterprise_linux_appstream_eus_v_8_8 patched: - enterprise_linux_server_v_7_els - openshift_dev_spaces 3 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_2 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_e4s_v_8_4 - enterprise_linux_appstream_tus_v_8_4 - enterprise_linux_appstream_aus_v_8_6 - enterprise_linux_appstream_e4s_v_8_6 - enterprise_linux_appstream_tus_v_8_6 - enterprise_linux_appstream_eus_v_8_8 published: '2024-11-24' updated: '2026-10-15' sourceUpdated: '2026-10-15T11:08:39+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53899.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53899.json - url: 'https://access.redhat.com/security/cve/CVE-2024-53899' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2328554' - url: 'https://www.cve.org/CVERecord?id=CVE-2024-53899' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53899' - url: 'https://github.com/pypa/virtualenv/issues/2768' - url: 'https://github.com/pypa/virtualenv/pull/2771' - url: 'https://github.com/pypa/virtualenv/releases/tag/20.26.6' - url: 'https://access.redhat.com/errata/RHSA-2024:11048' - url: 'https://access.redhat.com/errata/RHSA-2025:0892' - url: 'https://access.redhat.com/errata/RHSA-2024:10953' - url: 'https://access.redhat.com/errata/RHSA-2024:11091' - url: 'https://access.redhat.com/errata/RHSA-2025:0002' - url: 'https://access.redhat.com/errata/RHSA-2024:11094' - url: 'https://access.redhat.com/errata/RHSA-2024:11093' - url: >- https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2024-187.yaml - url: 'https://github.com/pypa/virtualenv' tags: - csaf - vex - red-hat - osv - pip epss: 0.01572 epssPercentile: 0.75474 aliases: - GHSA-rqc4-2hc7-8c8v - BIT-virtualenv-2024-53899 - PYSEC-2024-187 ecosystem: pip scores: vendor: 7.8 osv: 8.4 ingestedAt: '2026-09-12T03:13:01.726Z' --- ## Overview A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system. ## Vendor advisories - **RHSA-2024:11048** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11048) - **RHSA-2025:0892** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3 · released 2025-02-03 · [advisory](https://access.redhat.com/errata/RHSA-2025:0892) - **RHSA-2024:10953** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2024-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2024:10953) - **RHSA-2024:11091** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11091) - **RHSA-2025:0002** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.4), Red Hat Enterprise Linux AppStream TUS (v.8.4) · released 2025-01-01 · [advisory](https://access.redhat.com/errata/RHSA-2025:0002) - **RHSA-2024:11094** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11094) - **RHSA-2024:11093** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.8) · released 2024-12-16 · [advisory](https://access.redhat.com/errata/RHSA-2024:11093) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed · no fix planned: OpenShift Lightspeed · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53899.json) **virtualenv: potential command injection via virtual environment activation scripts** — rated Important by Red Hat. Released 2024-11-24, updated 2026-10-15. Affected: - OpenShift Lightspeed Fixed: - Red Hat Enterprise Linux Server (v. 7 ELS) - Red Hat OpenShift Dev Spaces 3 - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream AUS (v. 8.2) - Red Hat Enterprise Linux AppStream AUS (v.8.4) - Red Hat Enterprise Linux AppStream E4S (v.8.4) - Red Hat Enterprise Linux AppStream TUS (v.8.4) - Red Hat Enterprise Linux AppStream AUS (v.8.6) - Red Hat Enterprise Linux AppStream E4S (v.8.6) - Red Hat Enterprise Linux AppStream TUS (v.8.6) - Red Hat Enterprise Linux AppStream EUS (v.8.8) No fix planned: - OpenShift Lightspeed Not affected: - Red Hat OpenShift Dev Spaces 3 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces - Red Hat Satellite 6 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:11048 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:0892 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2024:10953 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2024-53899) Affected packages: - `virtualenv < 20.26.6` Patched in: - `virtualenv 20.26.6` Source: https://osv.dev/vulnerability/GHSA-rqc4-2hc7-8c8v