CVE-2023-31543 pipreqs vulnerable to Dependency Confusion
Attackers can execute arbitrary code by exploiting dependency confusion in pipreqs via malicious PyPI packages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-31543?
CVE-2023-31543 is a critical vulnerability in n/a, published on 30 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
Weakness: CWE-427
Which versions are affected by CVE-2023-31543?
3 open source packages ship an affected version, including pipreqs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pipreqs PyPI | From 0.3.0 | 0.4.12 |
pipreqs PyPI | From 0.3.0 | 0.4.12 |
pipreqs PyPI | From 0.3.0 | 0.4.12 |
Linux distribution packages (1)
python-pipreqs openSUSE:Tumbleweed | All versions | 0.5.0-2.2 |
Products include Pipreqs Project Pipreqs.
How do I fix CVE-2023-31543?
Upgrade pipreqs to 0.4.12 or later.
Is CVE-2023-31543 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31543 exists.
Sources
Also known as GHSA-v4f4-23wc-99mh, PYSEC-2023-99, openSUSE-SU-2024:13041-1, openSUSE-SU-2026:12026-1.