Critical Remote Code Execution Vulnerability in pyyi Package
Summary
MAL-2026-17866: Malicious code in pyyi (PyPI). Affects pyyi versions 2.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pyyi package, available on PyPI, is designed to provide a command-line interface for Python users. It allows users to execute various commands, including unlocking features and managing configurations. However, a significant vulnerability has been identified that exposes users to potential remote code execution, making it crucial for users to understand the risks associated with this package.
Vulnerability Detail
The vulnerability stems from the pyyi package's console command named python2, which executes a function called run_payload() that fetches and executes code from a remote server. This process involves sending sensitive information, such as the hostname and OS, to a malicious server, which can then return a payload that is executed in memory. The vulnerability is exacerbated by the concealment of input transmission and failure messages, making it difficult for users to detect malicious activity. The potential ramifications include unauthorized access to systems and data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall pyyiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the pyyi package until a patch is confirmed. Additionally, consider using network monitoring tools to detect any unauthorized outbound connections that may indicate exploitation of this vulnerability.
Conclusion
The pyyi package has a critical vulnerability that exposes users to remote code execution risks. It is essential for users to update to the latest version of the package and consider workarounds to mitigate potential threats. Continuous monitoring and awareness of vulnerabilities are key to maintaining secure software environments.
See every vulnerability recorded for pyyi →
FAQ
The vulnerability allows for remote code execution by fetching and executing malicious payloads from a remote server.
You can use the Vulert playground at Vulert Scanner to monitor and check for vulnerabilities in your application without requiring any signup.
If an immediate update is not possible, refrain from using the pyyi package and monitor your network for any suspicious activity.
Yes, using network monitoring tools and avoiding the use of the pyyi package until it is patched can help mitigate risks.
You can visit Vulert at https://vulert.com, which provides real-time monitoring and alerts for open-source vulnerabilities.
