Command Injection in pip when used with Mercurial

低 3.3CVE-2023-5752 · GHSA-mq26-g339-26xf · PYSEC-2023-228 · 25/10/2023 公開 · 17/06/2026 更新

要点

CVE-2023-5752 は pip, pip (pypa) に影響する深刻度「低」 (CVSS 3.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.50%（全脆弱性の 43.0% より高い）。
対処：23.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
pip PyPI	`< 23.3`	`23.3`
pip pypa	`< 23.3`	`23.3`

概要

When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call (e.g. --config). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

NVD の説明

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.