T08 · Insecure Dependencies
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependency and Unverified Runtime Model Retrieval
- Content
View full analysis
Vulnerability Details
File Location:
requirements.txt:1
Related Locations:rapidocr_minimal.py:9, 18;models/README.md:45-47;README.md:9
Vulnerability Type: Supply-chain exposure through an unpinned dependency and unverified runtime artifacts
Risk Level: MediumVulnerable Code
text rapidocr-onnxruntime>=1.2.3The dependency is imported and initialized as follows:
python from rapidocr_onnxruntime import RapidOCR class RapidOCRSkill: def __init__(self): # Use the default configuration. Models are downloaded on first use. self.ocr = RapidOCR()The documented pre-download procedure invokes the same dependency directly:
bash python -c "from rapidocr_onnxruntime import RapidOCR; RapidOCR()"Technical Analysis
The version constraint
>=1.2.3permits installation of any future release ofrapidocr-onnxruntime. The project includes neither a lockfile nor package hashes, so installations are not reproducible and cannot ensure that the audited dependency version is the one ultimately executed.The package is imported at module load time and initialized through
RapidOCR(). Consequently, code supplied by the installed package executes within the Python process and inherits the process's privileges and access to OCR input files.The project documentation further states that the dependency obtains OCR models automatically on first invocation. However, the project does not pin exact model revisions or provide expected cryptographic checksums or signatures. Although no malicious behavior was found in the Skill's own source code, trust is delegated to mutable external package and model distribution channels.
This finding does not establish that the current dependency or models are malicious. It identifies an avoidable supply-chain weakness that could become exploitable if a future package release, package repository account, distribution endpoint, or artifact is compromised.
Attac
...[truncated 1755 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the open-ended version constraint with an exact, reviewed version:
text rapidocr-onnxruntime==<reviewed-version> -
Generate a hash-locked dependency file and require hash verification during installation:
bash pip install --require-hashes -r requirements.txt -
Pin all transitive dependencies through a reproducible lockfile generated from a controlled environment.
-
Record the exact expected model versions, canonical download URLs, file sizes, and SHA-256 hashes.
-
Verify every downloaded model against a trusted cryptographic digest before loading it. Reject missing, mismatched, or unexpectedly redirected artifacts.
-
Prefer reviewed, locally provisioned model files for sensitive or offline deployments. Disable automatic downloads where the dependency supports that configuration.
-
Install dependencies from a trusted, access-controlled package mirror and incorporate dependency provenance, vulnerability, and integrity checks into CI.
-
Run OCR under a dedicated, least-privileged account or sandbox with access restricted to required input files and model directories. Deny unnecessary outbound network access after approved artifacts have been provisioned.
-
Review dependency updates explicitly rather than accepting future releases automatically.
-