Riskcovery

CVE-2026-68939

Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

State
Published
Severity
2.0 Low
Published
Aug 18, 2026
Updated
Aug 18, 2026
Reserved
Jul 31, 2026

Read the record on cve.org

Description

Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0.

Scores

CVSSScoreVectorSource
4.02.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NGitHub_M

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
  • CWE-155 Improper Neutralization of Wildcards or Matching Symbols

Affected Products

ProductVersions
pyenvpyenv
  • < 2.8.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.