T08 · Insecure Dependencies
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependency Allows Unreviewed Future Releases
- Content
View full analysis
Vulnerability Details
File Location:
requirements.txt:1
Related Locations:README.md:11-16,generate_resume.py:15-20
Vulnerability Type: Unpinned third-party dependency and insufficient supply-chain integrity controls
Risk Level: MediumVulnerable Code
requirements.txt:1:text python-docx>=1.1.0The installation instructions in
README.md:11-16also install the latest resolver-selected release without integrity verification:bash # Install dependency pip install python-docx # Generate sample resume python scripts/generate_resume.py examples/sample_resume.json 示例简历.docxThe dependency is imported and trusted at runtime in
generate_resume.py:15-20:python try: from docx import Document from docx.shared import Pt, Inches, RGBColor from docx.enum.text import WD_ALIGN_PARAGRAPH, WD_TAB_ALIGNMENT from docx.oxml.ns import qn except ImportError:Technical Analysis
The lower-bound-only version constraint permits any future
python-docxrelease at or above version 1.1.0. The README is less restrictive because it installs the package without any version constraint. The project provides no lockfile, upper version bound, package hashes, or other integrity verification.Consequently, the dependency installed by a user may differ from the version reviewed during the audit. Python package installation can execute package-controlled build hooks, while subsequent imports execute package initialization code. If the legitimate package distribution or an authorized publisher account were compromised, the existing dependency rules could automatically accept a malicious future release.
This finding does not establish that the current
python-docxpackage is malicious. The vulnerability is the project's failure to constrain and verify the external code it installs and executes.Attack Path
- An attacker compromises the upstre ...[truncated 1271 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin
python-docxto an exact version that has been reviewed and tested:text python-docx==<reviewed-version> -
Generate and verify cryptographic hashes for the dependency and its transitive dependencies, then require hash validation:
bash python -m pip install --require-hashes -r requirements.txt -
Commit a reproducible lockfile containing exact versions and hashes for all transitive dependencies.
-
Update the README so its installation command uses the locked requirements rather than installing an unconstrained package directly:
bash python -m pip install --require-hashes -r requirements.txt -
Perform dependency updates through a controlled review process that includes release-note review, vulnerability scanning, and functional testing.
-
Install and execute dependencies inside a dedicated, non-privileged virtual environment or isolated build container. Avoid installing packages as an administrator or root user.
-