PT-2026-53632 · Pypi · Vcspull

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.

Fix

Related Identifiers

PYSEC-2026-563

Affected Products

Vcspull

References · 11

• https://osv.dev/vulnerability/PYSEC-2026-563 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21187 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/libvcs/PYSEC-2022-163.yaml · Note
• https://github.com/vcs-python/vcspull/commit/e1b77128a1fa0754625b5f43d8bc47956f21f33e · Note
• https://github.com/vcs-python/vcspull/blob/master/CHANGES#vcspull-1111-2022-03-12 · Note
• https://github.com/vcs-python/libvcs/pull/306 · Note
• https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12 · Note
• https://github.com/vcs-python/libvcs/blob/master/CHANGES#libvcs-0111-2022-03-12 · Note
• https://github.com/advisories/GHSA-mv2w-4jqc-6fg4 · Note
• https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204 · Note
• https://pypi.org/project/vcspull · Note