GitHub Advisoryadvisory · PyPI

GHSA-mq26-g339-26xf Command Injection in pip when used with Mercurial

MEDIUM Published 2023-10-25 Modified 2025-11-03 Official page ↗
Aliases
CVE-2023-5752
Ecosystem
PyPI
Packages
pip
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-77
Reviewed
2023-10-30

Affected packages

• PyPI pip: < 23.3 → fixed in 23.3

Description

When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Related

Alias · CVE (1)

  • CVE-2023-5752 When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References