Approved changes feed: RSS · Atom
cpe:2.3:a:pyenv:pyenv:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Pyenv (4bb13988-bc01-5200-84ec-02824c0c2e06) |
|---|---|
| Product | Pyenv (c298b3d2-8057-5df3-bfb2-61bc7044d7e1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pyenv/pyenv |
purl2cpe | 2026-06-01 10:16:13.977054 |
pkg:pypi/pyenv |
purl2cpe | 2026-06-01 10:16:13.977057 |
pkg:rpm/opensuse/pyenv |
purl2cpe | 2026-06-01 10:16:13.977060 |
pkg:sourceforge/pyenv.mirror |
purl2cpe | 2026-06-01 10:16:13.977063 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-35861 |
vulnerable | 2026-06-08 05:46:05.879822 |
Details available
pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)
Published: 2022-07-17T16:31:03.000Z
Updated: 2024-08-03T09:44:22.146Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.