CVE-2024-9287

7.8 HIGH

📋 TL;DR

This vulnerability in CPython's venv module allows command injection when creating virtual environments with attacker-controlled path names. Attackers can execute arbitrary commands when users activate malicious virtual environments using 'source venv/bin/activate'. Only users who activate virtual environments created by attackers are affected.

💻 Affected Systems

Products:

CPython

Versions: All CPython versions before 3.12.9, 3.13.1, and 3.14.0a7

Operating Systems: All operating systems where CPython runs

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects virtual environments created with the 'venv' module or 'python -m venv' command. Virtual environments created with other tools (virtualenv, conda) are not affected.

📦 What is this software?

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

Python by Python

Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.

Learn more about Python →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise through arbitrary command execution with the privileges of the user activating the virtual environment, potentially leading to data theft, ransomware deployment, or lateral movement.

🟠

Likely Case

Limited command execution in development environments, potentially compromising developer workstations or CI/CD pipelines that use untrusted virtual environments.

🟢

If Mitigated

No impact if users only activate trusted virtual environments or use direct Python binary execution (./venv/bin/python).

🌐 Internet-Facing: LOW - Virtual environments are typically created and used locally, not exposed directly to the internet.

🏢 Internal Only: MEDIUM - Internal developers and CI/CD systems could be targeted through malicious virtual environments in shared repositories or package distributions.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires the victim to create a virtual environment from attacker-controlled input and then activate it using 'source' command. The vulnerability is in the activation script generation, not in the activation itself.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: CPython 3.12.9, 3.13.1, and 3.14.0a7

Vendor Advisory: https://github.com/python/cpython/security/advisories/GHSA-xxxx-xxxx-xxxx

Restart Required: No

Instructions:

1. Upgrade to CPython 3.12.9, 3.13.1, or 3.14.0a7 or later. 2. For existing virtual environments, delete and recreate them with the patched version. 3. No system restart required, but affected virtual environments need recreation.

🔧 Temporary Workarounds

Avoid source activation

all

Use direct Python binary execution instead of activating virtual environments with 'source' command

./venv/bin/python script.py
./venv/bin/pip install package

Validate virtual environment paths

all

Only create virtual environments from trusted, non-user-controlled path names

🧯 If You Can't Patch

Only create virtual environments from trusted, non-user-controlled path names
Use direct Python binary execution (./venv/bin/python) instead of activating virtual environments

🔍 How to Verify

Check if Vulnerable:

Check CPython version: python --version. If version is before 3.12.9, 3.13.1, or 3.14.0a7, you are vulnerable.

Check Version:

python --version

Verify Fix Applied:

After upgrading, verify version is 3.12.9+, 3.13.1+, or 3.14.0a7+. Test by creating a virtual environment with special characters in path and checking activation scripts.

📡 Detection & Monitoring

Log Indicators:

Unusual command execution during virtual environment activation
Suspicious activity in virtual environment directories

Network Indicators:

Outbound connections from Python processes during virtual environment activation

SIEM Query:

Process execution where command contains 'source' and path to virtual environment activation script followed by unexpected child processes

📊 Metadata

CVE ID: CVE-2024-9287

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-428

Published: October 22, 2024

Last Updated: November 3, 2025

🔗 References