Every CVE Search/ Get API key

CVE-2014-1927

python-gnupg's shell_quote function does not properly quote strings

7.5 HighFix available

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Exploit likelihood

3.42%Up 0.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
CVE-2014-1927
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
CVE-2014-1927
Updated
2026-11-02
EUVDEUVD-2014-0088 No score

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
EUVD-2014-0088
Updated
2026-11-03
GitHub AdvisoriesGHSA-r3vr-prwv-86g9 8.7

python-gnupg's shell_quote function does not properly quote strings

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
GHSA-r3vr-prwv-86g9
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-r3vr-prwv-86g9 8.7

python-gnupg's shell_quote function does not properly quote strings

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
GHSA-r3vr-prwv-86g9
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSV No score

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
CVE-2014-1927
Updated
2026-11-02
OSVDEBIAN-CVE-2014-1927 No score

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
DEBIAN-CVE-2014-1927
Updated
2026-11-02
OSVPYSEC-2014-90 No score

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
PYSEC-2014-90
Updated
2026-11-02
OSVUBUNTU-CVE-2014-1927 No score

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Record
UBUNTU-CVE-2014-1927
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-gnupg
PyPI
 0.3.5 to 0.3.5
0.3.6
python-gnupg
Debian:12
 before 0.3.6-1
0.3.6-1
python-gnupg
Debian:13
 before 0.3.6-1
0.3.6-1
python-gnupg
Debian:14
 before 0.3.6-1
0.3.6-1
python-gnupg
Debian:7
From an advisory covering 4 CVEs
 before 0.3.6-1~deb7u1, plus listed versions
0.3.0-1.10.3.4-10.3.5-10.3.5-2
0.3.6-1~deb7u1
python-gnupg
PyPI
 0.3.5 up to 0.3.6
0.3.6
python-gnupg
Ubuntu:14.04:LTS
 before 0.3.6-1, plus listed versions
0.3.5-2
0.3.6-1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-1927 is a high vulnerability (CVSS 7.5) in Python-gnupg Project Python-gnupg, published June 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.42%, the 88th percentile. Fixed in python-gnupg 0.3.6.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open