PT-2026-53632 · Pypi · Vcspull

Publicado 2026-06-29 · Atualizado 2026-06-29

OSV

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.

Correção

Identificadores relacionados

PYSEC-2026-563

Produtos afetados

Vcspull

Referências · 11

• https://github.com/pypa/advisory-database/tree/main/vulns/libvcs/PYSEC-2022-163.yaml · Nota
• https://github.com/vcs-python/vcspull/commit/e1b77128a1fa0754625b5f43d8bc47956f21f33e · Nota
• https://github.com/vcs-python/vcspull/blob/master/CHANGES#vcspull-1111-2022-03-12 · Nota
• https://github.com/vcs-python/libvcs/pull/306 · Nota
• https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12 · Nota
• https://github.com/vcs-python/libvcs/blob/master/CHANGES#libvcs-0111-2022-03-12 · Nota
• https://github.com/advisories/GHSA-mv2w-4jqc-6fg4 · Nota
• https://osv.dev/vulnerability/PYSEC-2026-563 · Aviso do Fabricante
• https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204 · Nota
• https://pypi.org/project/vcspull · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-21187 · Nota de Segurança