T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependencies Create Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2`; installation guidance also appears in `SKILL.md:164-166` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-2`: ```text pandas plotly ``` `SKILL.md:164-166`: ```text pip install plotly pandas ``` ### Technical Analysis The project installs `pandas` and `plotly` without exact versions or package hashes. Consequently, separate installations can resolve to different releases, including versions published after this project was audited. Python packages can execute code during installation and when imported. The application imports both dependencies near the beginning of `scripts/main.py`, so a malicious or compromised release could also execute with the privileges of the user running the chart generator. The package names are legitimate and there is no evidence that the currently available releases are malicious. The vulnerability is the absence of controls that ensure users install the exact dependency artifacts reviewed and tested by the project. ### Attack Path 1. An attacker compromises a future release, distribution account, package index, dependency source, or resolution path associated with one of the declared packages. 2. A user follows the documented installation command or runs `pip install -r requirements.txt`. 3. Because no versions or hashes are specified, pip accepts the attacker-controlled artifact if it satisfies normal resolution rules. 4. Malicious package code executes during installation or when `scripts/main.py` imports the dependency. 5. The code operates with the filesystem, network, and process privileges of the Python environment and user performing the installation or execution. ### Impact Assessment Successful exploitation could execute arbitrary Python code with the privileges of the installing or executing user. Depending on those privileges, this could expose accessible input da ...[truncated 325 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin each direct dependency to an explicitly reviewed version, for example: ```text pandas==<reviewed-version> plotly==<reviewed-version> ``` 2. Generate a lock file containing hashes for direct and transitive dependencies, and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Generate locked dependencies from a controlled package index and retain the lock file in source control. 4. Use an isolated virtual environment and avoid installing the project as a privileged or administrative user. 5. Add automated dependency vulnerability and integrity scanning to the release process. 6. Review and deliberately update dependency pins rather than allowing installations to resolve arbitrary future releases. ]]>