CVE catalog

CVE-2026-68939

pyenv-2.8.4-1.1 on GA media

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpyenv132.5.4-1vulnerable
Debianpyenv132.5.5-1vulnerable
Debianpyenv132.5.5-2vulnerable
Debianpyenv132.6.27-1vulnerable
Debianpyenv132.6.28-1vulnerable
Debianpyenv132.6.8-1vulnerable
Debianpyenv132.7.1-1vulnerable
Debianpyenv142.5.4-1vulnerable
Debianpyenv142.5.5-1vulnerable
Debianpyenv142.5.5-2vulnerable
Debianpyenv142.6.27-1vulnerable
Debianpyenv142.6.28-1vulnerable
Debianpyenv142.6.8-1vulnerable
Debianpyenv142.7.1-1vulnerable
Opensusepyenvleap 16.02.4.14-bp160.2.1fixed
Opensusepyenvtumbleweed2.8.4-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Opensusepyenvrpmleap 16.02.4.14-bp160.2.1Not reportedOPENSUSE-SU-2026:21664-1Not reported
Opensusepyenvrpmtumbleweed2.8.4-1.1Not reportedOPENSUSE-SU-2026:11613-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [pyenv]Affected
    Details (2)

    • 2.5.4-1 · all · trixie

      Affected

      pypi · pyenv · debian · 13

    • 2.5.4-1 · all · trixie

      Affected

      pypi · pyenv · debian · 13

[openSUSE Tumbleweed]

  • [pyenv-bash-completion]Unknown

    Source package: [pyenv]

    Details (1)

    • 2.8.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.8.4-1.1

      Version impact unknown

      pypi · pyenv · opensuse · tumbleweed

  • [pyenv-fish-completion]Unknown

    Source package: [pyenv]

    Details (1)

    • 2.8.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.8.4-1.1

      Version impact unknown

      pypi · pyenv · opensuse · tumbleweed

  • [pyenv-zsh-completion]Unknown

    Source package: [pyenv]

    Details (1)

    • 2.8.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.8.4-1.1

      Version impact unknown

      pypi · pyenv · opensuse · tumbleweed

  • [pyenv]Fixed

    Source package: [pyenv]

    Details (1)

    • 2.8.4-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 2.8.4-1.1

      pypi · pyenv · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]