← Database

CVE-2024-53899

HIGH CVSS: 7.8 Published: 2024-11-24 Modified: 2026-06-17

Description

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Affected Platforms

Virtualenv Virtualenv

Weakness Type

CWE-77, CWE-78

References