T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependency Allows Uncontrolled Package Resolution## Vulnerability Details **File Location**: `requirements.txt:1` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Complete Code Snippet**: ```text requests ``` ### Technical Analysis The project declares `requests` without an exact version or integrity hash. Consequently, each installation may resolve to a different package release based on the mutable state of the configured package index. This prevents reproducible dependency verification and increases exposure to supply-chain compromise, malicious package-index behavior, or an unexpectedly incompatible future release. Although the dependency name is not an apparent typosquat and no malicious package behavior was identified in the reviewed project, the installation process does not ensure that users receive the same reviewed artifact. ### Attack Path 1. An attacker compromises the configured package index, a dependency distribution channel, or a future eligible release. 2. A user installs the project dependencies using `pip install -r requirements.txt`. 3. The package resolver selects the attacker-controlled or otherwise unreviewed release because no exact version or hash is required. 4. Package installation logic or imported runtime code executes in the user's Python environment. 5. The malicious dependency acts with the permissions of the user or automation account performing installation or running the assay script. ### Impact Assessment Successful exploitation could permit arbitrary Python code execution with the privileges of the installing or executing account. Depending on that account's permissions, the affected scope could include project data, accessible files, environment variables, network resources, and credentials available to the Python process. This finding does not itself provide privilege escalation beyond the invoking account.
- Remediation
- ## Remediation Suggestions - Pin `requests` to an exact, reviewed version, such as `requests==X.Y.Z`. - Generate and commit a lock file that captures all transitive dependency versions. - Require cryptographic hashes during installation, for example by using a hash-locked requirements file with `pip install --require-hashes`. - Configure installations to use trusted package indexes over TLS and restrict unapproved additional indexes. - Add automated dependency vulnerability and provenance scanning to the release process. - Regularly update pins through a controlled review and testing workflow rather than allowing unconstrained resolution at installation time.