PYSEC-2023-228: pip fixed in 23.3

PYSEC-2023-228 PUBLISHED CVSS 3.299999952316284 LOW

Record from OSV · Published October 25, 2023

pip is fixed in 23.3 (PyPI)

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
pip	PyPI	23.3

Risk scores

CVSS 3.1

3.299999952316284

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

Vendor	Product	Versions
PyPI	pip	10.0.0b1, 0.2.1, 0.3

Timeline

Oct 25, 2023 CVE Published
Mar 24, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln PYSEC-2023-228
vulnetix vdb fixes PYSEC-2023-228

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/PYSEC-2023-228/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →