CVE-2014-1928
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- python-gnupg_project:python-gnupg
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2jc8-4r6g-282j | PyPI | python-gnupg | >=0.3.5 <0.3.6 | 0.3.6 |
| PYSEC-2014-91 | PyPI | python-gnupg | <0.3.6 | 0.3.6 |