GHSA-v4f4-23wc-99mh

pipreqs vulnerable to Dependency Confusion

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-31543

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pipreqs	>= 0.3.0, < 0.4.12	0.4.12

Details

As written in the advisory (Markdown source, shown as plain text).

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-31543 advisory
https://github.com/bndr/pipreqs/pull/364 web
https://github.com/bndr/pipreqs/commit/3f5964fcb90ec6eb6df46d78e651a1b73538d0ba web
https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe web
https://github.com/bndr/pipreqs package
https://github.com/bndr/pipreqs/blob/master/pipreqs/pipreqs.py#L447-L449 web
https://github.com/pypa/advisory-database/tree/main/vulns/pipreqs/PYSEC-2023-99.yaml web