CVE-2026-68939 Command injection in pyenv
Attackers can exploit unquoted glob expansion in pyenv to silently substitute Python interpreters, potentially leading to code execution or security bypass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68939?
CVE-2026-68939 is a low-severity command injection vulnerability in pyenv, published on 18 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0.
Which versions are affected by CVE-2026-68939?
Linux distribution packages (2)
pyenv openSUSE:Leap 16.0 | All versions | 2.4.14-bp160.2.1 |
pyenv openSUSE:Tumbleweed | All versions | 2.8.4-1.1 |
How do I fix CVE-2026-68939?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-68939 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-68939 exists.
Sources
Also known as DEBIAN-CVE-2026-68939, GHSA-g478-f579-9vp9, UBUNTU-CVE-2026-68939, openSUSE-SU-2026:11613-1, openSUSE-SU-2026:21664-1.