{"id":"CVE-2024-9287","aliases":[],"cve":{"records":[{"id":"CVE-2024-9287","source":"PSF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2024-09-27T14:48:44.181Z","published":"2024-10-22T16:34:39.210Z","modified":"2026-10-30T10:50:52.314Z"}],"publishers":[{"name":"PSF","role":"CNA","organizationId":"28c92f92-d60d-412d-b760-e73465c3df22","modified":"2025-01-31T19:55:27.648Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T10:50:52.314Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2025-11-03T22:33:21.116Z"}],"references":[{"url":"https://github.com/python/cpython/issues/124651","tags":["issue-tracking"],"source":"PSF"},{"url":"https://github.com/python/cpython/pull/124712","tags":["patch"],"source":"PSF"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/","tags":["vendor-advisory"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b","tags":["patch"],"source":"PSF"},{"url":"https://security.netapp.com/advisory/ntap-20250425-0006/","tags":[],"source":"CVE"},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","tags":[],"source":"CVE"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-428","description":"CWE-428 Unquoted Search Path or Element","source":"PSF"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2025-07-23T03:55:30.785809Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Virtual environment (venv) activation scripts don't quote paths","titleSource":"PSF","descriptionSource":"PSF","description":"A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment \"activation\" scripts (ie \"source venv/bin/activate\"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie \"./venv/bin/python\") are not affected.","score":5.3,"severity":"medium","published":"2024-10-22T16:34:39.210Z","modified":"2026-10-30T10:50:52.314Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Python Software Foundation","name":"CPython","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.9.21","versionType":"python"},{"version":"3.10.0","status":"affected","lessThan":"3.10.16","versionType":"python"},{"version":"3.11.0","status":"affected","lessThan":"3.11.11","versionType":"python"},{"version":"3.12.0","status":"affected","lessThan":"3.12.8","versionType":"python"},{"version":"3.13.0","status":"affected","lessThan":"3.13.1","versionType":"python"},{"version":"3.14.0a1","status":"affected","lessThan":"3.14.0a2","versionType":"python"}],"defaultStatus":"unaffected","cpes":[],"source":"PSF","url":"https://www.cve.org/CVERecord?id=CVE-2024-9287"}],"remediation":[],"references":["https://github.com/python/cpython/issues/124651","https://github.com/python/cpython/pull/124712","https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/","https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483","https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7","https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db","https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8","https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97","https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b","https://security.netapp.com/advisory/ntap-20250425-0006/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"],"sources":[{"name":"CVE","id":"CVE-2024-9287","modified":"2026-10-30T10:50:52.314Z","url":"https://www.cve.org/CVERecord?id=CVE-2024-9287"}],"assessments":[{"source":"PSF","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-30T10:56:17.064Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:15:31.991Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T11:00:31.994Z","attemptedAt":"2026-10-30T11:00:31.994Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T11:00:31.994Z","attemptedAt":"2026-10-30T11:00:31.994Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T11:00:31.994Z","attemptedAt":"2026-10-30T11:00:31.994Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T11:00:31.994Z","attemptedAt":"2026-10-30T11:00:31.994Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-grqq-hcc7-crmr","url":"https://github.com/advisories/GHSA-grqq-hcc7-crmr","modified":"2025-11-04T00:31:48Z","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T11:00:31.994Z"},{"source":"FIRST EPSS","id":"CVE-2024-9287","url":"https://www.first.org/epss/","probability":0.00648,"percentile":0.50957,"date":"2026-10-29","checkedAt":"2026-10-30T11:00:31.994Z"},{"source":"ENISA EUVD","id":"EUVD-2024-50376","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50376","modified":"Oct 30, 2026, 10:50:52 AM","score":5.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Green","checkedAt":"2026-10-30T11:00:31.994Z"},{"source":"NVD","id":"CVE-2024-9287","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9287","modified":"2026-06-17T08:24:17.270","score":5.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","checkedAt":"2026-10-30T11:00:31.994Z"},{"source":"NVD","id":"CVE-2024-9287","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9287","modified":"2026-06-17T08:24:17.270","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T11:00:31.994Z"}],"aiSummary":null}