T08 · Insecure Dependencies
- Location
scripts/generate_docs.py:19- Finding
Python Import-Path Precedence Enables Local Dependency Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_docs.py, lines 19–22
Vulnerability Type: Local dependency hijacking through unsafe Python import-path manipulation
Risk Level: MediumVulnerable Code
python # 添加父目录到路径以导入模块 sys.path.insert(0, str(Path(__file__).parent.parent.parent / 'docx' / 'scripts')) try: from docx import DocumentTechnical Analysis
The script prepends an external sibling directory,
../../docx/scripts, tosys.pathbefore importingdocx. Index0gives this directory precedence over the normal Python package search locations, including the installedpython-docxdependency.Consequently, a file named
docx.pyor a package nameddocxin that sibling directory can shadow the legitimate dependency. Python executes top-level module code during import, so a malicious replacement could run arbitrary Python code as soon as the document-generation script starts.The project documentation declares
python-docxas the dependency but does not disclose or validate this alternative local module source. Exploitation requires an attacker to control or modify the siblingdocx/scriptsdirectory or influence how the project is deployed alongside another component.Attack Path
- The attacker obtains write access to the sibling
docx/scriptsdirectory, or distributes a manipulated adjacent component containing that path. - The attacker creates
docx.pyor adocxpackage containing malicious top-level Python code. - A user or Agent invokes
scripts/generate_docs.py, including for PPT generation because the import occurs at startup. - The script inserts the attacker-controlled directory at the beginning of
sys.path. - Python resolves
from docx import Documentagainst the malicious local module before the legitimate installed package. - The malicious module executes with the privileges of the invoking process.
Impact Assessment
Successful exploitation provides arbitrary Python c ...[truncated 582 chars]
- The attacker obtains write access to the sibling
- Remediation
View remediation
Remediation Suggestions
- Remove the import-path modification:
python sys.path.insert(0, str(Path(__file__).parent.parent.parent / 'docx' / 'scripts'))- Import the installed
python-docxpackage through Python’s standard package resolution:
python try: from docx import Document from docx.shared import Inches, Pt, RGBColor from docx.enum.text import WD_ALIGN_PARAGRAPH from docx.enum.style import WD_STYLE_TYPE except ImportError: ...-
Declare dependencies in a dedicated dependency manifest and pin reviewed versions, preferably with integrity hashes.
-
Run the Skill in an isolated virtual environment so unrelated sibling directories cannot influence dependency resolution.
-
If shared local code is genuinely required, package it under a unique project namespace rather than using the third-party package name
docx. -
Avoid adding broad or externally writable directories to
sys.path. Where unavoidable, resolve and validate the expected path, verify ownership and permissions, and reject symlinks or unexpected package contents. -
Add an automated test that verifies the loaded
docxmodule originates from the approved virtual environment or package installation location.