—

PYSEC-2023-99

Quick fix

PYSEC-2023-99 — pipreqs: upgrade to the fixed version with the command below.

pip install --upgrade 'pipreqs>=0.4.12'

Details

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/pipreqs

Introduced in: 0.3.0Fixed in: 0.4.12

Fixpip install --upgrade 'pipreqs>=0.4.12'

References

https://github.com/bndr/pipreqs/pull/364[EVIDENCE]
https://github.com/bndr/pipreqs/pull/364[WEB]
https://github.com/bndr/pipreqs/pull/364[FIX]
https://github.com/bndr/pipreqs/pull/364[ADVISORY]
https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe[EVIDENCE]
https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe[WEB]
https://github.com/advisories/GHSA-v4f4-23wc-99mh[ADVISORY]