Back to Database
Status published
High
CVE-2020-11073
Remote Code Execution in Autoswitch Python Virtualenv
Vulnerability Description
In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could run arbitrary code without any user interaction. This is fixed in version: 1.16.0
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-11073
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/security/advisories/GHSA-h8wm-cqq6-957q
- https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/issues/122
- https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/pull/123
- https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv/commit/30c77db7c83eca2bc5f6134fccbdc117b49a6a05
Affected Vendor
MichaelAquilina
View all reports →Affected Software
zsh-autoswitch-virtualenv
Vulnerable Versions:
< 0.16.0
Timeline
Official Publish:
May 13th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N