CVE-2022-21668
Pipenv's requirements.txt parsing allows malicious index url in comments
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). When pip installs from a source distribution, any code in the setup.py is executed by the install process. This issue is patched in version 2022.1.8. The GitHub Security Advisory contains more information about this vulnerability.
Timeline
ID reserved
By GitHub_M
- 55 days later
· 55 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 3.9% · top 9.6% of all CVEs (8 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.
Weakness
- CWE-20: Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') (opens in a new tab)All about CWE-77 and its CVEs
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs
- CWE-427: Uncontrolled Search Path Element (opens in a new tab)All about CWE-427 and its CVEs
- CWE-791: Incomplete Filtering of Special Elements (opens in a new tab)All about CWE-791 and its CVEs
- CWE-190 (opens in a new tab)All about CWE-190 and its CVEs
- CWE-1284 (opens in a new tab)All about CWE-1284 and its CVEs
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPIpipenvGHSA-qc9x-gjcv-465w (opens in a new tab)
References (6)
- https://github.com/pypa/pipenv/security/advisories/GHSA-qc9x-gjcv-465w (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/pypa/pipenv/commit/439782a8ae36c4762c88e43d5f0d8e563371b46f (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/pypa/pipenv/releases/tag/v2022.1.8 (opens in a new tab)x_refsource_MISCx_transferred
- FEDORA-2022-77ce20f03a (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- FEDORA-2022-508e460384 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- FEDORA-2022-0d007466b3 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-qc9x-gjcv-465w (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-21668)Record last updated .