PT-2023-7006 · Pypi+4 · Pip+4

Paul Gerste + 1 · Published 2023-10-24 · Updated 2026-05-07 · CVE-2023-5752

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pip versions prior to v23.3

Description The issue is related to the injection of arbitrary configuration options to the "hg clone" call when installing a package from a Mercurial VCS URL using pip. This can modify how and which repository is installed. The vulnerability does not affect users who aren't installing from Mercurial.

Recommendations For pip versions prior to v23.3, update to version v23.3 or later to resolve the issue. As a temporary workaround, consider avoiding the installation of packages from Mercurial VCS URLs until the issue is resolved. Restrict access to the hg clone call to minimize the risk of exploitation. Avoid using the --config option in the "hg clone" call until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

AZL-39958

AZL-60006

BDU:2023-08026

BIT-PIP-2023-5752

CVE-2023-5752

DLA-4348-1

ECHO-1342-C991-4C68

GHSA-MQ26-G339-26XF

MGASA-2025-0055

OPENSUSE-SU-2023_4988-1

OPENSUSE-SU-2024:13454-1

OPENSUSE-SU-2024_3156-1

PYSEC-2023-228

RHSA-2024:3781

SUSE-SU-2023:4987-1

SUSE-SU-2023:4988-1

SUSE-SU-2023_4987-1

SUSE-SU-2024:0892-1

SUSE-SU-2024:3156-1

SUSE-SU-2024_0892-1

Affected Products

Astra Linux

Debian

Red Os

Suse

Pip

References · 57

• https://github.com/pypa/pip/pull/12306 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-5752 · Security Note
• https://mail.python.org/archives/list/[e-mail]/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0055.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-5752 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08026 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-5752 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-39958 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4987-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-5752 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pip-2023-5752 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-228 · Vendor Advisory