T08 · Insecure Dependencies
Note
- Location
- scripts/generate.py:26
- Finding
- Unpinned Third-Party Dependency Installation Guidance## Vulnerability Details **File Location**: `scripts/generate.py:26-32` and `scripts/generate.py:44-48` **Vulnerability Type**: Unpinned dependencies and mutable package resolution **Risk Level**: Low ### Vulnerable Code ```python try: from docx import Document from docx.shared import Pt, RGBColor, Inches from docx.enum.text import WD_ALIGN_PARAGRAPH from docx.oxml.ns import qn from docx.oxml import OxmlElement except ImportError: print("ERROR: python-docx required. Install with: pip3 install python-docx pyyaml") sys.exit(1) ``` The same insecure installation recommendation is repeated for the YAML dependency: ```python else: print("ERROR: PyYAML not installed. Use .json config or: pip3 install pyyaml") sys.exit(1) ``` ### Technical Analysis The generator recommends installing `python-docx` and `pyyaml` directly from the package index without specifying reviewed versions or cryptographic hashes. The project contains no lockfile or hash-verified requirements manifest. Consequently, dependency resolution is mutable: running the displayed command at different times may install different package releases and transitive dependencies. If an upstream package, release process, package-index account, or transitive dependency is compromised, malicious code could execute during installation or when the generator imports the package. This finding does not establish that the named packages are currently malicious. The weakness is the absence of reproducible, integrity-verified dependency resolution. ### Attack Path 1. An attacker compromises a dependency release, maintainer account, distribution channel, or relevant transitive dependency. 2. A user runs the generator without one of the required modules installed. 3. The script displays `pip3 install python-docx pyyaml` or `pip3 install pyyaml`. 4. The user follows the recommendation, causing `pip` to resolve the latest a ...[truncated 814 chars]
- Remediation
- ## Remediation Suggestions 1. Add a reviewed dependency manifest containing exact versions, such as `requirements.txt`. 2. Include SHA-256 hashes for every direct and transitive distribution and require hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Generate and review the locked dependency set using a reproducible dependency-management tool. 4. Replace the inline installation recommendation with instructions referencing the locked manifest. 5. Run automated dependency vulnerability and provenance checks in CI. 6. Install dependencies inside an isolated virtual environment and avoid elevated installation privileges. 7. Periodically update pinned versions through a controlled review and testing process.