Python CPython up to 3.13.0 venv /venv/bin/python unquoted search path

Summaryinfo

A vulnerability marked as critical has been reported in Python CPython up to 3.13.0. Impacted is an unknown function of the file /venv/bin/python of the component venv. The manipulation leads to unquoted search path. This vulnerability is referenced as CVE-2024-9287. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Python CPython up to 3.13.0. This issue affects an unknown code of the file /venv/bin/python of the component venv. The manipulation with an unknown input leads to a unquoted search path vulnerability. Using CWE to declare the problem leads to CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-9287 since 09/27/2024. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/02/2025). The attack technique deployed by this issue is T1574.009 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 210114 (SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python3 (SUSE-SU-2024:3879-1)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (210114) and CERT Bund (WID-SEC-2025-1567). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Oracle MySQL
• Ubuntu Linux
• Oracle Linux
• RESF Rocky Linux
• Xerox FreeFlow Print Server

Productinfo

Type

• Programming Language Software

Vendor

• Python

Name

• CPython

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13.0

License

• open-source

Website

• Product: https://github.com/python/cpython/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion