Test ID:	1.3.6.1.4.1.25623.1.0.114841
Category:	General
Title:	Python Command Injection Vulnerability (Oct 2024) - Windows
Summary:	Python is prone to a command injection vulnerability in the venv; module.
Description:	Summary: Python is prone to a command injection vulnerability in the venv module. Vulnerability Insight: A vulnerability has been found in the venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the virtual environment creator to inject commands into virtual environment 'activation' scripts (ie 'source venv/bin/activate'). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie './venv/bin/python') are not affected. Affected Software/OS: Python versions prior to 3.9.21, 3.10.x prior to 3.10.16, 3.11.x prior to 3.11.11, 3.12.x prior to 3.12.8 and 3.13.x prior to 3.13.1. Solution: Update to version 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1 or later. CVSS Score: 6.8 CVSS Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2024-9287
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.