T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded Third-Party Dependency Creates Supply-Chain Risk
- Content
View full analysis
=1.2.0 ``` `SKILL.md:21`: ```text Prerequisite dependency: `python-docx`; if it is missing, install it using `pip install -r requirements.txt`. ``` `README.md:22-26`: ```bash pip install -r requirements.txt ``` ```text Dependency: `python-docx>=1.2.0`. ``` ### Technical Analysis The dependency specification establishes only a minimum version. It allows pip to install any later `python-docx` release available from the configured package index. The project does not provide an exact version pin, integrity hashes, or a lockfile. Consequently, the dependency code installed and subsequently imported may differ from the version reviewed during this audit. If an allowed future release, package-index account, distribution artifact, configured mirror, or source distribution is compromised, attacker-controlled code could be introduced into the installation or document-processing workflow. This is a supply-chain hardening issue rather than evidence that the current `python-docx` package is malicious. ### Attack Path 1. A user follows the documented command: ```bash pip install -r requirements.txt ``` 2. Pip resolves `python-docx` to any available version equal to or newer than 1.2.0. 3. An attacker compromises a permitted future release, distribution artifact, package-index account, or configured mirror. 4. Pip downloads the compromised artifact because it satisfies the unrestricted version constraint. 5. Malicious code executes through a source-distribution build hook or later when the dependency is imported by one of the project scripts. 6. The code runs with the privileges of the user executing pip or the document-processing script. ### Impact Assessment Successful exploitation could ...[truncated 493 chars]- Remediation
View remediation
``` Include hashes for required transitive dependencies and install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a dependency-locking tool such as `pip-tools` to produce a reproducible lockfile containing exact transitive versions and hashes. 4. Recommend installation inside a dedicated virtual environment using a trusted package index: ```bash python -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt ``` 5. Review and test dependency updates before changing the pinned version. Use automated vulnerability and provenance checks where available. 6. Update `SKILL.md` and `README.md` so their installation instructions require the locked, hash-verified dependency set rather than an open-ended version range. ]]>