CVE-2022-35861

    Dashboard / Vulnerabilities / CVE-2022-35861

    CVE-2022-35861

    Published: 17 Jul 2022Last Modified: 12 Aug 2026

    Summary:

    Details: pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35861.json, https://nvd.nist.gov/vuln/detail/CVE-2022-35861, https://github.com/pyenv/pyenv/commit/22fa683571d98b59ea16e5fe48ac411c67939653

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 80e418eca535b9c7cbdd0f8557586eaaf872000d
    Fixed -22fa683571d98b59ea16e5fe48ac411c67939653

    Affected versions

    v2.3.2
    v2.3.1
    v2.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35861 | CVE-DB