CVE-2023-31543

CRITICAL

pipreqs <0.5 - RCE

Title source: llm

Description

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.

References (2)

Scores

CVSS v3 9.8
EPSS 0.0064
EPSS Percentile 70.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-427
Status published

Affected Products (2)

pipreqs_project/pipreqs < 0.4.11
pypi/pipreqs < 0.4.12PyPI

Timeline

Published Jun 30, 2023
Tracked Since Feb 18, 2026