{"id":"CVE-2024-29864","aliases":["DEBIAN-CVE-2024-29864","EUVD-2024-26855","GHSA-px53-89vh-3q6f","UBUNTU-CVE-2024-29864"],"status":"published","title":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into...","description":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.02934,"percentile":0.87271,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2024-03-21T00:00:00Z","modified":"2026-11-11T10:30:59Z","fixes":[{"ecosystem":"Debian:13","package":"distrobox","fixed_in":["1.7.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"distrobox","fixed_in":["1.7.0.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"distrobox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"distrobox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"distrobox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2.1-1","1.5.0.2-1","1.6.0.1-1","1.7.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"distrobox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"distrobox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.2.4-1","1.8.2.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"distrobox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1.2-1","1.8.2.2-1","1.8.2.4-1"]}],"products":[{"vendor":"89luca89","product":"distrobox"},{"vendor":"distrobox","product":"distrobox"}],"references":[{"url":"https://github.com/89luca89/distrobox/commit/82a69f0a234e73e447d0ea8c8b3443b84fd31944","tags":["x_transferred","Patch","fix","report"]},{"url":"https://github.com/89luca89/distrobox/issues/1275","tags":["x_transferred","Exploit","Issue Tracking","Patch","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29864","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-px53-89vh-3q6f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29864.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-29864","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-29864","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29864","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-29864","description":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.","status":"published","published":"2024-03-21T00:00:00Z","modified":"2024-09-04T17:28:18.935Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:14.985673Z"}],"euvd":[{"id":"EUVD-2024-26855","description":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.","status":"published","published":"2024-03-21T00:00:00Z","modified":"2024-09-04T17:28:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:04.166522Z"}],"ghsa":[{"id":"GHSA-px53-89vh-3q6f","title":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into...","description":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.","status":"published","published":"2024-03-21T06:33:05Z","modified":"2024-09-04T21:31:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:58:10.296286Z"}],"nvd":[{"id":"CVE-2024-29864","description":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.","status":"published","published":"2024-03-21T04:15:09.557Z","modified":"2026-06-17T07:23:15.6Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-29864","description":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.","status":"published","published":"2024-03-21T00:00:00Z","modified":"2026-11-11T10:30:59.767160604Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-11T11:06:28.524794Z"},{"id":"DEBIAN-CVE-2024-29864","description":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.","status":"published","published":"2024-03-21T04:15:09.557Z","modified":"2026-11-02T12:02:14.752944351Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"UBUNTU-CVE-2024-29864","description":"Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.","status":"published","published":"2024-03-21T04:15:00Z","modified":"2026-10-17T12:56:44.220835615Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:48.333535Z"}]}}