T08 · Insecure Dependencies
Warning
- Location
README_en.md:87- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
README_en.md:87-90
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: MediumVulnerable Code
markdown ### Python Dependencies (for generating Word reports) ```bash pip install python-docxtext ### Technical Analysis The installation command resolves and installs the latest available version of `python-docx`. The project does not provide a version constraint, dependency lockfile, package hash, or trusted-environment requirement. Because package resolution is mutable, the code installed by users can differ from the version reviewed by the project author. Python package installation may execute package build or installation logic with the privileges of the invoking user. If the package, one of its transitive dependencies, or the configured package index is compromised, following the documented command could execute unauthorized code. No evidence indicates that `python-docx` is currently malicious. The vulnerability is the absence of controls that ensure users receive a known, reviewed dependency artifact. ### Attack Path 1. An attacker compromises a future dependency release, transitive dependency, or package distribution channel. 2. A user follows the documented `pip install python-docx` command. 3. `pip` resolves the compromised or unexpectedly changed package version. 4. Malicious build, installation, or imported runtime code executes locally. 5. The payload operates with the permissions of the user who installed or ran the package. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that user's privileges, the attacker could access user-readable files, modify project files, steal environment credentials, tamper with generated reports, or establish persistence outside this project. The affected scope is the environment where the depend ...[truncated 129 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
python-docxto a specifically reviewed version. - Provide a dependency lockfile containing resolved transitive dependencies.
- Publish verified hashes and require hash checking during installation, for example with
pip install --require-hashes -r requirements.txt. - Recommend installation in a dedicated virtual environment rather than the system Python environment.
- Use a trusted package index and document the expected package source.
- Add automated dependency vulnerability and integrity scanning to the release process.
- Review and deliberately update the pinned dependency instead of automatically accepting the latest release.
- Pin