T08 · Insecure Dependencies
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependencies Allow Unreviewed Supply-Chain Changes
- Content
View full analysis
Vulnerability Details
File Location:
requirements.txt:1-9
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
text akshare yfinance numpy pandas matplotlib scipy reportlab streamlit>=1.42.0 altair>=5.0.0Technical Analysis
Seven direct dependencies have no version constraints. The remaining two use only minimum-version constraints, with no upper bounds or integrity hashes. Consequently, package installation can resolve to releases that were never reviewed or tested with this project.
This makes installations non-reproducible and creates a supply-chain exposure. If a dependency's package registry account, publishing pipeline, or upstream release is compromised, the resolver may install attacker-controlled code. Python packages may execute code during installation, and all listed packages are imported into the application process, where malicious module-level code could also execute.
No dependency is confirmed to be malicious. The vulnerability is the unrestricted trust placed in future package releases rather than evidence of an existing malicious payload.
Attack Path
- An attacker compromises the publishing account, release pipeline, or upstream distribution channel of one of the declared packages.
- The attacker publishes a malicious version that still satisfies the unrestricted requirement or the
>=constraint. - A user or deployment system installs the project dependencies without a reviewed lockfile or required hashes.
- The package resolver selects and downloads the malicious release.
- Attacker-controlled code executes during package installation or when the application imports the affected package.
- The code runs with the privileges and environmental access of the installation or application process.
Impact Assessment
Successful exploitation could provide arbitrary code execution under the account running dependency installation or the Streamlit application. Depend ...[truncated 483 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every direct dependency to an exact, reviewed version rather than using unrestricted names or minimum-only constraints.
- Generate and commit a lockfile containing the complete transitive dependency graph.
- Require package hashes during deployment, such as with a hash-locked requirements file and
pip install --require-hashes. - Install packages only from explicitly approved package indexes over authenticated TLS; disable unintended extra indexes to reduce dependency-confusion exposure.
- Run automated vulnerability and provenance checks against both direct and transitive dependencies.
- Perform dependency upgrades through a controlled process that includes source review, security scanning, compatibility testing, and financial-calculation regression tests.
- Build dependencies in an isolated, least-privileged environment and run the application with only the filesystem and network permissions required for market-data retrieval and report generation.