T08 · Insecure Dependencies
- Location
scripts/extract_maoworks_articles.py:21- Finding
Unpinned Third-Party Dependency Installation Guidance
- Content
View full analysis
Vulnerability Details
File Location:
scripts/extract_maoworks_articles.py, lines 21–26
Vulnerability Type: Unpinned third-party dependency and insufficient supply-chain verification
Risk Level: MediumVulnerable Code:
python try: import docx except ImportError: print("ERROR: python-docx not installed. Run: pip install python-docx") sys.exit(1)Technical Analysis
When the required module is unavailable, the script recommends installing
python-docxwithout specifying a reviewed version, cryptographic hash, lockfile, package index, or isolated environment. Consequently, the installed artifact is determined by the user's active pip configuration and the package repository state at installation time rather than by an auditable dependency specification.The code does not automatically run pip, and
python-docxis not itself demonstrated to be malicious. Exploitation therefore requires compromise or manipulation of the relevant package source, package resolution process, pip configuration, or network trust boundary. If that prerequisite is met, installation or subsequent import of the resolved package could execute attacker-controlled Python code.Attack Path
- A user invokes the extraction script in an environment where the
docxmodule is unavailable. - The script displays the command
pip install python-docx. - The user executes that unpinned command.
- Pip resolves the dependency using the user's configured package index and current repository state.
- An attacker who has compromised or influenced that supply-chain path causes a malicious or altered package artifact to be resolved.
- Attacker-controlled code executes during package installation or when the script subsequently imports the installed module.
Impact Assessment
Malicious dependency code would execute with the privileges of the user running pip or the extraction script. It could potential ...[truncated 520 chars]
- A user invokes the extraction script in an environment where the
- Remediation
View remediation
Remediation Suggestions
- Declare
python-docxin a maintained dependency file and pin it to a specifically reviewed version. - Use a hash-locked installation mechanism, such as a requirements file generated with verified SHA-256 hashes.
- Configure installation to use an explicitly approved HTTPS package index rather than arbitrary user-configured sources.
- Install dependencies inside an isolated virtual environment with ordinary user privileges; do not recommend elevated or system-wide installation.
- Add automated dependency vulnerability and integrity checks to the release process.
- Replace the current message with a controlled installation instruction, for example:
text Create an isolated virtual environment and install dependencies from the project's hash-locked requirements file: python -m pip install --require-hashes -r requirements.txt- Document the reviewed dependency version, expected hashes, supported Python versions, and the process for safely updating the lockfile.
- Declare