PYSEC-2023-99
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/pipreqs/PYSEC-2023-99.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2023-99
- Aliases
- Published
- 2023-06-30T20:15:00Z
- Modified
- 2026-06-10T17:02:29.025319375Z
- Summary
- [none]
- Details
-
A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
- References
-
- https://github.com/bndr/pipreqs/pull/364
- https://github.com/bndr/pipreqs/pull/364
- https://github.com/bndr/pipreqs/pull/364
- https://github.com/bndr/pipreqs/pull/364
- https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe
- https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe
- https://github.com/advisories/GHSA-v4f4-23wc-99mh
Affected packages
PyPI / pipreqs
Package
- Name
- pipreqs
- View open source insights on deps.dev
- Purl
- pkg:pypi/pipreqs