---
id: CVE-2024-53899
aliases:
  - GHSA-rqc4-2hc7-8c8v
  - BIT-virtualenv-2024-53899
  - PYSEC-2024-187
title: >-
  virtualenv allows command injection through activation scripts for a virtual
  environment
summary: >-
  virtualenv allows command injection through activation scripts for a virtual
  environment
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: virtualenv
product: virtualenv
ecosystem: pip
affected:
  - virtualenv < 20.26.6
patched:
  - virtualenv 20.26.6
published: '2024-11-24'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:56.097648777Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rqc4-2hc7-8c8v'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53899'
  - url: 'https://github.com/pypa/virtualenv/issues/2768'
  - url: 'https://github.com/pypa/virtualenv/pull/2771'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2024-187.yaml
  - url: 'https://github.com/pypa/virtualenv'
  - url: 'https://github.com/pypa/virtualenv/releases/tag/20.26.6'
tags:
  - osv
  - pip
epss: 0.01572
epssPercentile: 0.74397
ingestedAt: '2026-09-12T03:13:01.726Z'
---

## Overview

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

## Affected packages

- `virtualenv < 20.26.6`

## Remediation

Upgrade to a patched release:

- `virtualenv 20.26.6`