T08 · Insecure Dependencies
- Location
README.md:35- Finding
Unpinned Third-Party Dependencies Permit Unreviewed Supply-Chain Changes
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 35–39
Vulnerability Type: Unpinned package installation from the configured Python package index
Risk Level: MediumVulnerable Code Snippet:
bash # Required — core PDF text/table extraction pip install pdfplumber # Required for render_page (page → PNG) — install at least one: pip install pymupdf # preferred: MuPDF engine, faster pip install pypdfium2 # fallback: PDFium engine (Chrome's renderer)Technical Analysis
The installation instructions retrieve three third-party packages without exact version constraints, cryptographic hashes, a lock file, or a restriction to a trusted package index. Consequently, installations performed at different times can resolve to package versions that were not reviewed as part of this audit.
The package names are consistent with the imports used by
scripts/pdf_tools.py, and no evidence of typosquatting or a currently malicious package was identified. The security issue is the unconstrained dependency resolution: compromise of an upstream package, malicious publication through a configured index, dependency confusion, or an unsafe package-index configuration could cause attacker-controlled code to be installed.Python packages may execute code during installation and when imported. In this project, the dependencies process user-supplied PDF files, so a compromised dependency would also have direct access to potentially sensitive document contents.
Attack Path
- A user follows the installation commands in
README.md. pipresolves the unpinned dependency through the user's configured package index.- An upstream compromise, malicious mirror, unsafe index configuration, or subsequently compromised release causes an unreviewed package version to be selected.
- The malicious package executes code during installation or when
pdf_tools.pyimports it. - The package acts with ...[truncated 892 chars]
- A user follows the installation commands in
- Remediation
View remediation
Remediation Suggestions
-
Add a reviewed dependency manifest with exact versions, such as
requirements.txt:text pdfplumber==<reviewed-version> pymupdf==<reviewed-version> pypdfium2==<reviewed-version> -
Generate and record cryptographic hashes for all direct and transitive dependencies, then require hash verification:
bash python -m pip install --require-hashes -r requirements.txt -
Use a lock-file workflow, such as
pip-tools, to pin the complete transitive dependency graph rather than only top-level packages. -
Document and enforce a trusted package index. Avoid untrusted extra indexes and consider an internally controlled package mirror for production deployments.
-
Install dependencies inside an isolated virtual environment under a non-privileged account. Do not run the installation commands with administrator or root privileges.
-
Add automated dependency vulnerability and integrity checks to the release process, and review upgrades before updating pinned versions.
-