LiveActive security incident?Get immediate response
CVE Record

CVE-2022-35861: pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current...

pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw affects pyenv installations where a local user can influence the current directory. A malicious .python-version value can make pyenv run attacker-controlled shims instead of the expected interpreter path, creating a local privilege escalation risk. The source bundle does not show remote exploitation, CVSS scoring, or KEV listing.

Executive priority

Prioritize remediation on CI runners, shared developer systems, and any privileged automation using pyenv. For isolated single-user developer machines, urgency is lower, but affected versions should still be upgraded during standard endpoint hardening.

Technical view

pyenv versions 1.2.24 through 2.3.2 used the .python-version string to construct a command path without validating that it named a valid Python version. That allowed relative path traversal to attacker-controlled shim executables. The described attack requires local directory influence and pyenv command execution from that directory.

Likely exposure

Most likely exposure is developer workstations, shared Unix hosts, and CI/build runners using affected pyenv versions where untrusted users or repositories can place .python-version files.

Exploitation context

The source bundle supports a local privilege escalation scenario, not remote compromise. KEV is false, and no cited source states active exploitation in the wild. Risk rises where privileged automation runs pyenv from user-writable or externally supplied directories.

Researcher notes

Evidence is limited to the CVE description, CVE record, CVE List entry, and upstream commit. The bundle provides no CVSS vector, CWE mapping, exploit-in-the-wild evidence, or explicit fixed release number beyond the referenced commit.

Mitigation direction

  • Inventory pyenv installations and identify versions 1.2.24 through 2.3.2.
  • Apply the upstream fix or upgrade beyond the affected range when vendor guidance confirms.
  • Avoid running pyenv-managed commands inside directories writable by untrusted users.
  • Restrict write access to shared workspaces and repositories containing .python-version files.
  • Review the fixing commit and pyenv guidance for exact remediation details.

Validation and detection

  • Check endpoint and CI inventory for affected pyenv versions.
  • Confirm installed pyenv includes the upstream fixing commit or a later fixed release.
  • Inspect shared workspaces for .python-version files from untrusted sources.
  • Verify privileged jobs do not run pyenv from attacker-writable directories.
  • Review operational logs for unexpected shim execution from user-writable paths.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-35861 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.