---
id: CVE-2024-9287
title: Virtual environment (venv) activation scripts don't quote paths
summary: >-
  A vulnerability has been found in the CPython `venv` module and CLI where path
  names provided when creating a virtual environment were not quoted properly,
  allowing the creator to inject commands into virtual environment "activation"
  scr…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green'
cvssSource: cna
cwe:
  - CWE-428
vendor: Python Software Foundation
product: CPython
affected:
  - CPython < 3.9.21
  - CPython >= 3.10.0 < 3.10.16
  - CPython >= 3.11.0 < 3.11.11
  - CPython >= 3.12.0 < 3.12.8
  - CPython >= 3.13.0 < 3.13.1
  - CPython >= 3.14.0a1 < 3.14.0a2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-07-23T03:55:30.785809Z'
published: '2024-10-22'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T10:50:52.314Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-9287'
references:
  - url: 'https://github.com/python/cpython/issues/124651'
  - url: 'https://github.com/python/cpython/pull/124712'
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/
  - url: >-
      https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483
  - url: >-
      https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7
  - url: >-
      https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db
  - url: >-
      https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8
  - url: >-
      https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97
  - url: >-
      https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b
tags:
  - cve.org
epss: 0.00648
epssPercentile: 0.5105
ingestedAt: '2026-11-03T10:42:03.636Z'
---

## Overview

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

## Affected

- `CPython < 3.9.21`
- `CPython >= 3.10.0 < 3.10.16`
- `CPython >= 3.11.0 < 3.11.11`
- `CPython >= 3.12.0 < 3.12.8`
- `CPython >= 3.13.0 < 3.13.1`
- `CPython >= 3.14.0a1 < 3.14.0a2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.