Every CVE Search/ Get API key

CVE-2022-24065

Command Injection

8.1 HighFix available

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.20%Up 3.2 points since Jun 4, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.1

Command Injection

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
CVE-2022-24065
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated
2026-11-02
EUVDEUVD-2022-0047 8.1

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
EUVD-2022-0047
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated
2026-11-03
GitHub AdvisoriesGHSA-f4q6-9qm4-h8j4 9.2

OS Command Injection in cookiecutter

The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
GHSA-f4q6-9qm4-h8j4
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
NVD 8.1

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
CVE-2022-24065
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-78
Updated
2026-11-02
OSV 8.1

Command Injection

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
CVE-2022-24065
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated
2026-11-02
OSVDEBIAN-CVE-2022-24065 9.8

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
DEBIAN-CVE-2022-24065
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 4 moreShow less
OSVGHSA-f4q6-9qm4-h8j4 9.2

OS Command Injection in cookiecutter

The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
GHSA-f4q6-9qm4-h8j4
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVUBUNTU-CVE-2022-24065 8.1

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
UBUNTU-CVE-2022-24065
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2022-0258 No score

Updated python-coookiecutter packages fix security vulnerability

Command Injection via hg argument (CVE-2022-24065)

Record
MGASA-2022-0258
Updated
2026-11-02
OSVPYSEC-2022-204 No score

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Record
PYSEC-2022-204
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cookiecutter
PyPI
 before 2.1.1
2.1.1
cookiecutter
Debian:12
 All versions, plus listed versions
1.7.3-32.6.0-12.6.0-2
 None known
cookiecutter
Debian:13
 before 2.6.0-1
2.6.0-1
cookiecutter
Debian:14
 before 2.6.0-1
2.6.0-1
cookiecutter
PyPI
 before 2.1.1, plus listed versions
0.10.20.2.10.30.4
Show 26 moreShow less
0.50.6.00.6.10.6.20.6.30.6.40.7.00.7.10.7.20.8.00.9.00.9.11.0.01.1.01.2.01.2.11.3.01.4.01.5.01.5.11.6.01.7.01.7.11.7.21.7.32.1.0
2.1.1
python-cookiecutter
Mageia:8
 before 1.7.2-2.mga8
1.7.2-2.mga8
cookiecutter
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.0.0-2ubuntu11.0.0-3ubuntu11.0.0-3ubuntu21.3.0-2
 None known
cookiecutter
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.5.0-21.5.1-11.6.0-11.6.0-1ubuntu21.6.0-2
 None known
cookiecutter
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.7.3-1
 None known
cookiecutter
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.7.3-32.6.0-1
 None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24065 is a high vulnerability (CVSS 8.1) in Cookiecutter Project Cookiecutter, published June 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.20%, the 91st percentile. Fixed in cookiecutter 2.1.1.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open