cbcvebase.
CVE-2023-5752
published 2023-10-25

CVE-2023-5752: When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject…

PriorityP415low3.3CVSS 3.1
AVLACLPRLUINSUCNILAN
EPSS
0.48%
37.5th percentile
When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Affected

12 ranges
VendorProductVersion rangeFixed in
debianpython-pip< python-pip 20.3.4-4+deb11u2 (bullseye)python-pip 20.3.4-4+deb11u2 (bullseye)
msrcazl3_mozjs_102.15.1-1_on_azure_linux_3.0
msrcazl3_python3_3.12.0-4_on_azure_linux_3.0
msrcazl3_python3_3.12.3-1_on_azure_linux_3.0
msrcazl3_tensorflow_2.16.1-9_on_azure_linux_3.0
msrcazure_linux_3.0_arm
msrcazure_linux_3.0_x64
msrccbl2_python-virtualenv_20.26.6-1_on_cbl_mariner_2.0
msrccbl2_python3_3.9.19-13_on_cbl_mariner_2.0
paloaltopan-os
pypapip< 23.323.3
pypapip>= 0 < 23.323.3

CVSS provenance

nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
osv3.3LOW
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_oracle3.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.