Prior to version 2.8.0, pyenv’s version‑selection logic accepts shell glob characters in .python-version files and unquoted PYENV_VERSION expansions. This allows an attacker who can supply such a file or environment variable to silently point pyenv to a different Python interpreter. The unintended interpreter may execute code with the user’s privileges, leading to possible local code execution or privilege escalation.

The vulnerability affects the Pyenv project (pyenv:pyenv). All releases before 2.8.0 are susceptible; versions 2.8.0 and later contain the fix.

With a CVSS score of 2 and no EPSS data, the vulnerability is assessed as low overall severity. However, exploitation requires local access and the presence of an attacker‑controlled .python-version file or PYENV_VERSION setting. Because the attack causes an interpreter substitution, any code run by that interpreter can be executed with the user’s rights. The CVE is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time.