CVE-2022-21187: Command Injection Vulnerability in vcspull Package
Summary
CVE-2022-21187: Command injection in libvcs and vcspull. Affects vcspull versions < 1.11.1. Fixed in 1.11.1. How to fix ↓
Also tracked for
The same CVE-2022-21187 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vcspull package is a Python tool that facilitates the management of version control systems (VCS) repositories. It allows users to easily clone, update, and manage repositories from various VCS platforms. However, prior to version 1.11.1, vcspull is vulnerable to command injection due to improper handling of user input when executing commands, particularly with Mercurial (hg).
Vulnerability Detail
The vulnerability arises from the way the vcspull package processes the 'url' parameter in the update_repo function when using the hg command. An attacker can inject malicious hg options into this parameter, leading to arbitrary command execution on the host system. This could allow an attacker to execute any command with the privileges of the user running the vcspull tool, potentially leading to data breaches, system compromise, or other malicious activities.
How To Fix
Minimum fixed version
1.11.1
This is the first release that contains the fix.
pip install --upgrade "vcspull==1.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid passing untrusted URLs to the vcspull update_repo function. Ensure that all URLs are from trusted sources and do not contain any additional hg options that could lead to command injection.
Conclusion
The command injection vulnerability in the vcspull package poses significant risks to users by allowing arbitrary command execution. It is crucial for users to update to the patched version 1.11.1 or later to mitigate these risks. Additionally, employing safe practices when handling URLs can help reduce exposure until updates are applied.
See every vulnerability recorded for vcspull →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, ensure that you do not use untrusted URLs with the update_repo function as a temporary measure.
Exploitation of this vulnerability can lead to arbitrary command execution, which may result in unauthorized access, data loss, or system compromise.
More information can be found in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/vcspull/PYSEC-2026-563.yaml.
