T08 · Insecure Dependencies
Warning
- Location
- install.sh:47
- Finding
- Unbounded Third-Party Dependency Installation## Vulnerability Details **File Location**: `install.sh:47-49` and `scripts/requirements.txt:1-4` **Vulnerability Type**: Unpinned and unhashed third-party dependencies **Risk Level**: Medium ### Vulnerable Code `install.sh:47-49`: ```bash # Install dependencies echo "Installing dependencies..." "$PIP" install --no-user -q -r "$REQ_FILE" ``` `scripts/requirements.txt:1-4`: ```text tvscreener>=0.2.0 pandas>=2.0.0 pyyaml>=6.0 pytest>=7.0.0 ``` ### Technical Analysis The documented installation process installs packages directly from pip's configured package index. Every dependency uses an open-ended lower-bound constraint, and the project provides neither a lockfile nor cryptographic package hashes. Consequently, installation results can change over time without any change to the reviewed project. Pip may select any future release satisfying these constraints. If an allowed package release or configured package source is compromised, attacker-controlled package code could run during installation or when the installed module is subsequently imported. The runtime environment also installs `pytest`, although it is only required for testing. This unnecessarily increases the production dependency footprint and supply-chain attack surface. No evidence in the audited project indicates that its authors intentionally introduced a malicious dependency. The risk arises from the non-reproducible and unauthenticated-by-project dependency resolution policy. ### Attack Path 1. An attacker compromises the publisher account, distribution infrastructure, or package-index delivery path for one of the allowed dependencies. 2. The attacker publishes or serves a malicious version whose number satisfies the applicable `>=` constraint. 3. A user follows the documented setup procedure and executes `install.sh`. 4. Pip resolves the malicious version because no exact version or expected hash restricts package selection. 5. Attacker-controlled code executes during package instal ...[truncated 790 chars]
- Remediation
- ## Remediation Suggestions 1. Replace lower-bound constraints with exact, reviewed versions for all runtime dependencies. 2. Generate and commit a reproducible lockfile appropriate to every supported platform and Python version. 3. Record cryptographic hashes for approved distributions and install with pip's `--require-hashes` option. 4. Separate runtime and development dependencies so `pytest` is not installed in production environments. 5. Use a controlled package index or repository mirror with provenance, access control, and package-retention policies. 6. Add automated dependency vulnerability scanning and require review before updating locked versions. 7. Consider using a constraints file and deployment command similar to: ```bash "$PIP" install --no-user --require-hashes -r requirements.lock ``` 8. Rebuild and test lockfiles regularly so security updates are adopted deliberately rather than through unrestricted version resolution.