T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Unpinned Python Dependencies Permit Unreviewed Supply-Chain Changes
- Content
View full analysis
=0.10.0 # DOCX document reading python-docx>=0.8.11 # Legacy DOC: macOS uses system textutil; other systems require LibreOffice. ``` When imports fail, the program recommends installing these dependencies directly: ```python try: import pdfplumber from docx import Document except ImportError: print("Missing dependencies. Run:") print( shlex.join( [sys.executable, "-m", "pip", "install", "-r", str(REQUIREMENTS_PATH)] ) ) raise SystemExit(1) ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. Consequently, a future release satisfying the constraint can be installed without having been reviewed with this project. Transitive dependency versions are also unlocked, and no package hashes are provided to verify artifact integrity. The installation command relies on the user's configured Python package index. If an allowed direct or transitive dependency is compromised, unexpectedly replaced, or resolved through an untrusted package index, package installation or later imports may execute attacker-controlled code with the privileges of the user running `pip` or the Skill. This finding does not establish that either named package is currently malicious. The vulnerability is the absence of reproducible, integrity-verified dependency resolution. ### Attack Path 1. An attacker compromises a future release of an allowed dependency or one of its transitive dependencies, or influences dependency resolution through an untrusted package index. 2. The user follows the documented `p ...[truncated 940 chars]- Remediation
View remediation
python-docx== ``` 2. Generate a lock file that includes all transitive dependencies. 3. Record package hashes and install with integrity enforcement: ```bash python3 -m pip install --require-hashes -r scripts/requirements-lock.txt ``` 4. Review and update locked dependencies through a controlled process that includes vulnerability scanning and regression testing. 5. Recommend installation in a dedicated virtual environment rather than the system Python environment. 6. Document the trusted package index explicitly and discourage installation from arbitrary mirrors. 7. Consider automated dependency monitoring, but do not automatically merge or deploy unreviewed upgrades. ]]>