T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependencies Permit Unreviewed Supply-Chain Changes<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-4` **Vulnerability Type**: Unpinned and integrity-unverified dependencies **Risk Level**: Medium ### Vulnerable Code ```text whisperx torch torchaudio openai ``` The documented installation procedure executes: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every direct dependency is specified without an exact version or integrity hash. Consequently, the package versions installed depend on the state of the configured Python package indexes at installation time rather than a previously reviewed and reproducible dependency set. The affected packages also introduce substantial transitive dependency trees. A malicious or compromised upstream release, altered package index, or dependency-resolution change could cause unreviewed code to be downloaded and installed. Python package installation may execute package build backends or other installation logic, while subsequently importing the installed libraries executes their runtime code with the privileges of the user running the application. There is no lock file, hash verification, or index restriction in the project to ensure that users receive the same reviewed artifacts. ### Attack Path 1. An attacker compromises an upstream dependency or one of its transitive dependencies, or causes a malicious release to be selected through the configured package index. 2. A user follows the documented `pip install -r requirements.txt` command. 3. Because no versions or hashes are constrained, pip resolves the affected release. 4. Malicious installation logic may execute during package installation, or malicious runtime code may execute when the scripts import `torch`, `whisperx`, or `openai`. 5. The payload operates with the privileges of the user or automation account performing the installation or running the scripts. This path depends on compromise or manipulation of an upstream package or package-resolution source; the a ...[truncated 709 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed exact version, for example with `package==x.y.z`. 2. Generate a fully resolved lock file that also pins transitive dependencies. 3. Record and enforce cryptographic hashes for downloaded artifacts, such as by using a hash-locked requirements file and: ```bash pip install --require-hashes -r requirements.txt ``` 4. Explicitly use trusted package indexes and prevent unintended fallback to untrusted or privately controlled indexes. 5. Install dependencies inside an isolated virtual environment or container using a non-privileged account. 6. Add automated dependency and vulnerability scanning to the release process. 7. Review and deliberately update dependency pins rather than automatically accepting the newest available release. ]]>