CVE-2024-53899

Name of the Vulnerable Software and Affected Versions: virtualenv versions prior to 20.26.6

Description: The issue is related to command injection through the activation scripts for a virtual environment in virtualenv. It is caused by the incorrect quoting of magic template strings when replacing, allowing an attacker to execute arbitrary commands. This can enable a remote attacker to perform unauthorized actions.

Recommendations: For versions prior to 20.26.6, upgrade to version 20.26.6 or later to resolve the issue. As a temporary workaround, consider disabling the activation scripts for virtual environments until a patch is available. Restrict access to the vulnerable activation scripts to minimize the risk of exploitation.