T08 · Insecure Dependencies
Warning
- Location
- scripts/requirements.txt:1
- Finding
- Unpinned and Unhashed Runtime Dependencies## Vulnerability Details **File Location**: `scripts/requirements.txt:1-2` **Vulnerability Type**: Supply-chain exposure through mutable dependency resolution **Risk Level**: Medium ```text finance-datareader>=0.9.96 pandas>=2.0 ``` ### Technical Analysis Both runtime dependencies use open-ended minimum-version constraints and have no integrity hashes. Consequently, the installation command documented by the project resolves whichever compatible releases are available from the configured package index at installation time. The installed code can therefore change without any modification to this audited project. The absence of exact version pins and artifact hashes prevents users from verifying that they are installing the dependency versions reviewed and tested by the project. It also increases exposure to compromised package releases, maintainer-account compromise, malicious dependency updates, and incompatible upstream changes. The dependencies are imported when `scripts/krx.py` starts, so code contained in a selected package executes under the invoking user's account at runtime. ### Attack Path 1. An attacker compromises an upstream dependency release process, maintainer account, distribution artifact, or one of its transitive dependencies. 2. The attacker publishes a newer release that still satisfies `finance-datareader>=0.9.96` or `pandas>=2.0`. 3. A user follows the documented installation process and runs `pip install -r scripts/requirements.txt`. 4. Pip resolves and installs the attacker-controlled compatible release because no exact version or hash is required. 5. The malicious package code executes when the CLI imports the affected dependency or invokes its functionality. ### Impact Assessment Malicious dependency code would execute with the same operating-system privileges as the user installing or running the CLI. Depending on those privileges and the execution environment, it could read or mod ...[truncated 375 chars]
- Remediation
- ## Remediation Suggestions 1. Replace open-ended constraints with exact, reviewed versions using `==`. 2. Generate and commit a lock file containing all transitive dependency versions. 3. Record SHA-256 hashes for every permitted distribution artifact and install with `pip --require-hashes`. 4. Perform dependency updates through a controlled review process that includes vulnerability scanning and regression testing. 5. Use a trusted package index and explicitly configure the index source to reduce dependency-confusion exposure. 6. Rebuild locked dependencies periodically so security fixes can be adopted without silently accepting unrelated future releases.