CVE-2024-9287

What it actually does

Improper quoting of user-supplied path names during virtual environment creation allows arbitrary command injection into generated activation scripts such as venv/bin/activate.

Why it matters to the business

Developers or automated pipelines that source activation scripts from attacker-supplied virtual environments can execute unintended commands, potentially leading to workstation or build-system compromise.

How an attack unfolds

An attacker supplies a path containing shell metacharacters when invoking python -m venv; the resulting activate script embeds the unquoted path, so any subsequent source venv/bin/activate executes the attacker's commands.

How to fix it

Upgrade CPython to a build containing commit 633555735a023d3e4d92ba31da35b1205f9ecbd7 or later; avoid sourcing activation scripts from untrusted virtual environments and prefer direct invocation of the venv interpreter.

How to confirm the fix worked

Confirm the installed CPython version includes commit 633555735a023d3e4d92ba31da35b1205f9ecbd7; test venv creation with a path containing spaces and single quotes and verify the activate script properly quotes the VIRTUAL_ENV variable.

Typical attack path

1. Attacker crafts a directory path containing shell metacharacters
2. Victim or CI job runs python -m venv with the malicious path
3. Generated activation script is written with the unquoted path
4. Victim or automation sources the activation script
5. Embedded commands execute in the victim's shell context

How to detect it

Search shell history, CI logs, and filesystem for venv creation commands containing unusual characters; inspect generated activate scripts for unquoted $VIRTUAL_ENV or PATH assignments that include suspicious strings.

• venv creation command containing single quotes, backticks, or dollar signs in the target path
• activate script lines containing unquoted $VIRTUAL_ENV or PATH assignments with embedded shell syntax

What your security team should do

• Prioritize patching CPython in all developer and CI images to the fixed commit
• Audit scripts and documentation that instruct users to source venv activation files
• Add static analysis or pre-commit hooks to detect unquoted VIRTUAL_ENV references