Critical Malicious Code Vulnerability in python-tg-bot Package
Summary
MAL-2025-192365: Malicious code in python-tg-bot (PyPI). Affects python-tg-bot versions 22.5 – 22.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The python-tg-bot package is a popular library used for building Telegram bots in Python. It provides a simple interface for interacting with the Telegram Bot API, allowing developers to create bots that can send messages, respond to user commands, and manage group chats. However, recent findings have revealed a critical vulnerability within this package that exposes users to potential data theft.
Vulnerability Detail
The vulnerability originates from a malicious dependency that is loaded during the import of the python-tg-bot package. This dependency contains an infostealer, which is designed to exfiltrate sensitive user credentials. The malicious code is intentionally included in the package's dependencies, posing a significant risk to users who may unknowingly install it. The ramifications of this vulnerability include unauthorized access to user accounts and potential data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall python-tg-botIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the python-tg-bot package until the vulnerability is fully addressed. Additionally, consider using alternative libraries for Telegram bot development that do not have known vulnerabilities.
Conclusion
The python-tg-bot package has been found to contain a critical vulnerability due to a malicious dependency that can exfiltrate user credentials. Users are advised to update to the latest version to mitigate this risk and consider alternative libraries if necessary. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-tg-bot →
FAQ
The vulnerability involves a malicious dependency that exfiltrates user credentials.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
You should immediately update to the latest patched version by running 'pip install --upgrade python-tg-bot'.
Yes, consider using other libraries such as python-telegram-bot or telepot that do not have this vulnerability.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock, ensuring you stay informed about potential risks.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
