T08 · Insecure Dependencies
Warning
- Location
- README.md:87
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `README.md`, lines 87-93 **Vulnerability Type**: Unpinned package installation from an external package index **Risk Level**: Medium **Vulnerable Code Snippet**: ```text ## Install Use Python 3.10 or later. The basic PNG charts require Pillow: ```text python -m pip install Pillow ``` ``` ### Technical Analysis The documented installation command requests Pillow without specifying an exact version or verifying package hashes. Although `THIRD-PARTY-NOTICES.md` identifies Pillow 12.3.0 as the version detected in the acceptance environment, the installation command does not enforce that version. Package resolution therefore depends on the current state of the configured Python package index. A future, compromised, or incompatible Pillow release could be installed without review. Installation may execute package build or installation logic with the privileges of the user running `pip`. This is a software supply-chain weakness rather than evidence that the currently referenced Pillow package is malicious. ### Attack Path 1. An attacker compromises a future Pillow distribution, a configured package index, or the dependency delivery path. 2. A user follows the documented command: `python -m pip install Pillow`. 3. `pip` resolves and downloads the currently available package instead of a specifically audited artifact. 4. Malicious package installation or build logic executes under the installing user's account. 5. The malicious dependency can access resources available to that account when installed or imported. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user installing or running the dependency. Potential scope includes files, environment variables, credentials, and network resources accessible to that user. No privilege escalation beyond the invoking user's permissions is established by the reviewed pro ...[truncated 102 chars]
- Remediation
- ## Remediation Suggestions 1. Pin Pillow to a reviewed exact version, such as `Pillow==12.3.0`, after confirming that version is appropriate and supported. 2. Place dependencies in a version-controlled requirements or lock file. 3. Record cryptographic hashes and install with hash enforcement, for example: ```text python -m pip install --require-hashes -r requirements.txt ``` 4. Generate and review hashes from a trusted package index for every supported platform and Python version. 5. Document the trusted package source and avoid unreviewed mirrors. 6. Use an isolated virtual environment and avoid installing dependencies with administrator or root privileges. 7. Add automated dependency vulnerability and integrity checks to the release process.