T08 · Insecure Dependencies
- Location
scripts/docx_gen.py:156- Finding
Unpinned Third-Party Python Dependency Installation Instructions
- Content
View full analysis
Vulnerability Details
File Locations:
scripts/docx_gen.py:156-158scripts/xlsx_tool.py:161-163scripts/inspect_doc.py:132-134
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: LowVulnerable Code
scripts/docx_gen.py:156-158python if not _DOCX_OK: print("[Error] Missing third-party library python-docx; install it first:") print(" pip install python-docx")scripts/xlsx_tool.py:161-163python if not _OPENPYXL_OK: print("[Error] Missing third-party library openpyxl; install it first:") print(" pip install openpyxl")scripts/inspect_doc.py:132-134python if not _DOCX_OK: print("[Error] Missing third-party library python-docx; install it first:") print(" pip install python-docx")Technical Analysis
The scripts instruct users to install
python-docxandopenpyxlwithout specifying reviewed versions, package hashes, an authenticated package source, or a dependency lock file. Consequently, pip resolves mutable package releases from whatever index is configured in the user's environment.The package names are legitimate and there is no evidence that this project intentionally introduces a malicious dependency. The scripts also do not perform installation automatically. Nevertheless, the instructions create a supply-chain trust boundary that is neither reproducible nor cryptographically verified.
A compromised upstream release, package repository, dependency of either package, or attacker-controlled pip mirror could supply malicious package content. Python package installation and subsequent import can execute package-controlled code with the privileges of the invoking user.
Attack Path
- A user invokes one of the scripts in an environment where the required package is unavailable.
- The script displays an instruction to run an unpinned
pip installcommand. - The user executes that command.
- Pip resolves the c ...[truncated 1275 chars]
- Remediation
View remediation
Remediation Suggestions
- Create a reviewed dependency file that pins exact versions:
text python-docx==REVIEWED_VERSION openpyxl==REVIEWED_VERSION- Generate and verify SHA-256 hashes for every direct and transitive dependency, then require hash validation during installation:
bash python -m pip install --require-hashes -r requirements.txt-
Use a lock-file workflow, such as
pip-tools, to produce deterministic transitive dependency versions. -
Update runtime guidance to direct users to the reviewed dependency file rather than installing unconstrained package names:
python print("Install the reviewed dependencies with:") print(" python -m pip install --require-hashes -r requirements.txt")-
Recommend installation in a dedicated virtual environment with ordinary user privileges. Do not recommend administrator or root installation.
-
Document the expected package index and advise users to verify pip configuration before installation. In controlled deployments, use an authenticated internal mirror containing reviewed artifacts.
-
Add automated dependency scanning and periodic review of pinned versions so security updates can be adopted without reverting to unconstrained installations.