T08 · Insecure Dependencies
Warning
- Location
scripts/color_lab.py:2- Finding
Unpinned Pillow Dependency in the CIELAB Image Analysis Script
- Content
View full analysis
=3.10" # dependencies = ["pillow"] # /// ``` ```text uv run /scripts/color_lab.py --surface spine --g 1.0 \ --target spine1.png --target spine2.png [--ref white-card.png] (or `pip3 install pillow` once and use plain python3). ``` ### Technical Analysis The script declares `pillow` without an exact version or integrity hash. Running it through `uv run` may dynamically resolve and install the currently available package release. The documented alternative, `pip3 install pillow`, has the same mutable resolution behavior. Consequently, the installed code is not necessarily the same dependency version that was reviewed or tested with this project. If the configured package index, distribution infrastructure, or a future Pillow release is compromised, package-controlled code could run during installation, import, or image processing. An unintentionally vulnerable future version could also expose the script to maliciously crafted image files. This is a supply-chain hardening issue. The audit did not establish that the current Pillow package is malicious. ### Attack Path 1. A user invokes the script with `uv run`, or follows the documented `pip3 install pillow` instruction. 2. The package manager resolves an unpinned Pillow release from its configured package source. 3. A compromised, substituted, or vulnerable release is downloaded and installed. 4. Package-controlled code executes during installation or when `PIL` is imported. 5. Alternatively, a vulnerable image decoder is reached when the script opens an attacker-controlled target or reference image. 6. The dependency code executes with the permissions of the account running the script. ### Impact Assessment Successful exploitation could provide co ...[truncated 455 chars]- Remediation
View remediation