VYPR
← All advisories
Critical severityNVD Advisory· Published Jun 30, 2023· Updated Nov 26, 2024

CVE-2023-31543

CVE-2023-31543

Description

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Dependency confusion in pipreqs before 0.4.13 allows attackers to execute arbitrary code by uploading a malicious PyPI package matching an imported module name.

Vulnerability

Description Pipreqs generates requirements.txt by mapping imported Python modules to their corresponding PyPI packages. The vulnerability in versions 0.3.0 to 0.4.11 arises from its remote dependency resolution mechanism (lines 447-449), which queries PyPI for any module name not found in its hardcoded mapping. If a module's exported name differs from its actual package name, an attacker can upload a malicious PyPI package with the same name as the module, leading to a dependency confusion attack [1][2].

Exploitation

Conditions Three prerequisites must be met: (1) the PyPI package name and its exported module name differ; (2) the module-name-to-package-name mapping is absent from pipreqs’s local file; (3) the module name is available as a package on PyPI. For example, the package djangorestframework-simplejwt exports the module rest_framework_simplejwt. If an attacker uploads a malicious rest_framework_simplejwt package, pipreqs will include it in the generated requirements file [1][2].

Impact

Successful exploitation results in arbitrary code execution on any system that processes the generated requirements.txt, such as during CI/CD pipelines or production deployments. The attacker achieves code execution with the privileges of the Python environment [2][3].

Mitigation

The issue was patched in pipreqs version 0.4.13 (released April 14, 2023) by improving local dependency resolution and adding a warning when remote resolution is used. Users should upgrade to the latest version or use the --use-local flag to avoid remote queries [1][3].

References
  1. Mitigation for dependency confusion in pipreqs by adeadfed · Pull Request #364 · bndr/pipreqs
  2. Dependency confusion in pipreqs
  3. NVD - CVE-2023-31543

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pipreqsPyPI
>= 0.3.0, < 0.4.120.4.12

Affected products

3

Patches

1
3f5964fcb90e

fix name resolution for local packages

https://github.com/bndr/pipreqsadeadfedMar 14, 2023via ghsa
commit
1 file changed · +7 −3
  • pipreqs/pipreqs.py+7 −3 modified
    @@ -229,7 +229,8 @@ def get_import_local(imports, encoding=None):
     result = []
     for item in imports:
         if item.lower() in local:
-            result.append(local[item.lower()])
+            # append to result a matching package, as well as its exported modules
+            result.append(dict(**local[item.lower()], exports=item.lower()))
 
     # removing duplicates of package/version
     result_unique = [
@@ -443,9 +444,12 @@ def init(args):
     else:
         logging.debug("Getting packages information from Local/PyPI")
         local = get_import_local(candidates, encoding=encoding)
+        
         # Get packages that were not found locally
-        difference = [x for x in candidates
-                      if x.lower() not in [z['name'].lower() for z in local]]
+        difference = [x for x in candidates 
+                        # check if candidate name is found in the list of exported modules, installed locally
+                        if x.lower() not in [y['exports'] for y in local]]
+
         imports = local + get_imports_info(difference,
                                            proxy=proxy,
                                            pypi_server=pypi_server)

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.