T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Python Dependencies and Mutable Machine-Learning Model Artifacts## Vulnerability Details **File Location**: `requirements.txt:1-6`, `README.md:29`, and `scripts/lib/analysis/sentiment.py:249-255` **Vulnerability Type**: Supply-chain integrity weakness **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-6`: ```text pandas>=2.0.0 pandas-ta>=0.3.14b httpx>=0.27.0 aiohttp>=3.9.0 pyyaml>=6.0 python-dateutil>=2.9.0 ``` `README.md:29`: ```text After installation, run `pip install -r requirements.txt` to install the Python dependencies. ``` `scripts/lib/analysis/sentiment.py:249-255`: ```python tokenizer = AutoTokenizer.from_pretrained( model_name, cache_dir=self.cache_dir ) model = AutoModelForSequenceClassification.from_pretrained( model_name, cache_dir=self.cache_dir ) ``` ### Technical Analysis The dependency manifest uses lower-bound version constraints without exact versions, upper bounds, or cryptographic hashes. As a result, identical installation commands can resolve to different package artifacts over time. The audited source therefore does not fully determine the code that will be installed and imported at runtime. The sentiment module first attempts to load models from the local cache, but if this fails it retrieves tokenizer and model artifacts from Hugging Face using repository names without an immutable `revision` value. A repository owner or compromised upstream account could replace artifacts associated with the mutable repository reference after this project has been reviewed. This issue does not establish that any currently referenced package or model is malicious. It is an integrity and reproducibility weakness that allows future upstream changes or compromises to affect the effective runtime components without a corresponding change to this repository. ### Attack Path 1. An attacker compromises a referenced package publisher, package index distribution path, or Hugging Face model repository. 2. The attacker publishes a malicious or altered artifact und ...[truncated 1573 chars]
- Remediation
- ## Remediation Suggestions 1. Replace lower-bound dependency constraints with exact, reviewed versions. 2. Generate and commit a lock file appropriate to the supported installation workflow. 3. Record cryptographic hashes for all resolved distributions and require hash verification during installation, such as with `pip install --require-hashes`. 4. Review and update dependencies through a controlled process that includes vulnerability scanning and regression testing. 5. Pin each Hugging Face model and tokenizer to an immutable repository commit using the `revision` parameter: ```python tokenizer = AutoTokenizer.from_pretrained( model_name, revision="REVIEWED_COMMIT_SHA", cache_dir=self.cache_dir, ) model = AutoModelForSequenceClassification.from_pretrained( model_name, revision="REVIEWED_COMMIT_SHA", cache_dir=self.cache_dir, ) ``` 6. Prefer safe tensor formats and disable remote custom code where supported. Explicitly retain `trust_remote_code=False`. 7. Validate downloaded artifacts against documented checksums or deploy them from an internally controlled, immutable artifact store. 8. Document that model warm-up and first-use sentiment analysis may perform external downloads. 9. Run installation and model loading as an unprivileged account in an isolated virtual environment or container with only the filesystem and network access required by the application.