CVE-2014-1927
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
- EPSS
- 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- python-gnupg_project:python-gnupg
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r3vr-prwv-86g9 | PyPI | python-gnupg | >=0.3.5 <0.3.6 | 0.3.6 |
| PYSEC-2014-90 | PyPI | python-gnupg | >=0.3.5 <0.3.6 | 0.3.6 |