T08 · Insecure Dependencies
Warning
- Location
- install.sh:16
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `install.sh`, line 16 **Vulnerability Type**: Supply-chain risk caused by an unpinned dependency **Risk Level**: Medium ### Vulnerable Code ```bash uv pip install python-docx ``` ### Technical Analysis The installation script retrieves `python-docx` without specifying an audited version or verifying a cryptographic hash. Consequently, the installed artifact depends on mutable package-index state and local package-index configuration at installation time. This does not prove that the current `python-docx` package is malicious. However, it creates a supply-chain exposure: a compromised package release, package index, mirror, or index configuration could provide attacker-controlled package content. Package installation may execute build backend or installation-related code with the privileges of the user running `install.sh`. ### Attack Path 1. An attacker compromises the configured Python package index, mirror, relevant package release, or dependency-resolution configuration. 2. The victim runs `./install.sh`. 3. Line 16 asks `uv` to resolve the latest acceptable `python-docx` distribution from the configured source. 4. `uv` downloads and installs the attacker-controlled distribution into `.venv`. 5. Malicious build or installation behavior executes with the installing user's privileges, or malicious runtime code is placed in the virtual environment for later execution. ### Impact Assessment Successful exploitation could execute arbitrary code under the account that runs the installer. This may permit access to that user's readable files, modification of files writable by that user, theft of accessible credentials, and tampering with generated documents or the local virtual environment. The script does not request elevated privileges, so the direct impact is normally limited to the installing user's permissions. System-wide compromise would require the installer to be run by a privileged account or an addition ...[truncated 38 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `python-docx` and all transitive dependencies to reviewed versions. 2. Generate and commit a lockfile containing cryptographic hashes. 3. Require hash verification during installation and reject artifacts whose hashes are absent or mismatched. 4. Explicitly configure an approved HTTPS package index rather than relying on mutable user or environment configuration. 5. Review and update locked dependencies through a controlled process with vulnerability and provenance checks. 6. Run installation as an unprivileged user in an isolated virtual environment. For example, use a fully locked requirements file: ```bash uv pip install --require-hashes -r requirements.lock ``` The lockfile should contain exact versions and SHA-256 hashes for every resolved distribution.