T08 · Insecure Dependencies
- Location
install.sh:16- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
install.sh, line 16
Vulnerability Type: Supply-chain risk caused by an unpinned dependency
Risk Level: MediumVulnerable Code
bash uv pip install python-docxTechnical Analysis
The installation script retrieves
python-docxwithout specifying an audited version or verifying a cryptographic hash. Consequently, the installed artifact depends on mutable package-index state and local package-index configuration at installation time.This does not prove that the current
python-docxpackage is malicious. However, it creates a supply-chain exposure: a compromised package release, package index, mirror, or index configuration could provide attacker-controlled package content. Package installation may execute build backend or installation-related code with the privileges of the user runninginstall.sh.Attack Path
- An attacker compromises the configured Python package index, mirror, relevant package release, or dependency-resolution configuration.
- The victim runs
./install.sh. - Line 16 asks
uvto resolve the latest acceptablepython-docxdistribution from the configured source. uvdownloads and installs the attacker-controlled distribution into.venv.- Malicious build or installation behavior executes with the installing user's privileges, or malicious runtime code is placed in the virtual environment for later execution.
Impact Assessment
Successful exploitation could execute arbitrary code under the account that runs the installer. This may permit access to that user's readable files, modification of files writable by that user, theft of accessible credentials, and tampering with generated documents or the local virtual environment.
The script does not request elevated privileges, so the direct impact is normally limited to the installing user's permissions. System-wide compromise would require the installer to be run by a privileged account or an addition ...[truncated 38 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin
python-docxand all transitive dependencies to reviewed versions. - Generate and commit a lockfile containing cryptographic hashes.
- Require hash verification during installation and reject artifacts whose hashes are absent or mismatched.
- Explicitly configure an approved HTTPS package index rather than relying on mutable user or environment configuration.
- Review and update locked dependencies through a controlled process with vulnerability and provenance checks.
- Run installation as an unprivileged user in an isolated virtual environment.
For example, use a fully locked requirements file:
bash uv pip install --require-hashes -r requirements.lockThe lockfile should contain exact versions and SHA-256 hashes for every resolved distribution.
- Pin