T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned and Unverified Third-Party Dependencies## Vulnerability Details **File Location**: `requirements.txt:1-3` **Vulnerability Type**: Insecure dependency resolution and missing integrity verification **Risk Level**: Medium ### Complete Code Snippet ```text OpenEXR==3.2.4 numpy<2 Pillow ``` The installation workflow is documented in `SKILL.md:18-22`: ```bash pip install -r requirements.txt ``` ### Technical Analysis The dependency manifest does not provide a reproducible or integrity-verified dependency set: - `numpy<2` permits the package resolver to select any available release below version 2. - `Pillow` has no version constraint. - No package is protected by an expected cryptographic hash. - Transitive dependencies are not locked. Consequently, the code installed by this workflow can change without a corresponding change to the audited project. Installation may also execute package build or installation logic with the privileges of the user running `pip`. This finding concerns mutable and unverified supply-chain inputs. The audit did not find evidence that the named dependencies are intentionally malicious or that this project performs dependency confusion or typosquatting. ### Attack Path 1. A user follows the setup instructions and runs `pip install -r requirements.txt`. 2. `pip` contacts its configured package index and dynamically resolves the unconstrained or partially constrained packages. 3. An attacker compromises a permitted release, package-index account, distribution artifact, or configured package source. 4. Because no hashes are specified, `pip` accepts the altered artifact if ordinary index and transport validation succeeds. 5. Malicious installation hooks, native components, or subsequently imported package code execute in the local Python environment. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user performing the installation or running the EXR utility. Depending on those privileges and the host environment, ...[truncated 399 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version, including `numpy` and `Pillow`. 2. Resolve and lock all transitive dependencies for each supported Python version and platform. 3. Record SHA-256 hashes for every permitted distribution and require verification during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Generate the locked manifest through a controlled process, such as `pip-compile --generate-hashes`, and review updates before merging them. 5. Prefer binary wheels from a trusted, explicitly configured package index. Restrict fallback to untrusted or unintended indexes. 6. Install into an isolated virtual environment under a non-privileged account rather than using system Python or administrative privileges. 7. Add automated dependency vulnerability and provenance checks to the release process.