Critical Malicious Code Vulnerability in reqparser Package
Summary
MAL-2026-17181: Malicious code in reqparser (PyPI). Affects reqparser versions 1.0.0 – 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The reqparser package is a Python library available on PyPI, designed to facilitate the parsing of request data in web applications. It is commonly used in various projects to streamline data handling from HTTP requests. However, this package has been compromised, leading to significant security concerns due to the introduction of malicious code that can exfiltrate sensitive information.
Vulnerability Detail
The vulnerability originates from a malicious version of the reqparser package, specifically versions 1.0.0 and 1.0.1, uploaded by the user kam193. Upon import, the package activates an infostealer that targets cryptocurrency wallets and web browser data. It ensures persistence on the system and can install additional malware. The code also includes mechanisms to detect if it is running in a sandbox environment, making it more dangerous as it can evade detection during security assessments.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall reqparserIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the reqparser package until a secure version is confirmed. If your application relies heavily on this package, consider using alternative libraries for request parsing, such as Flask's built-in request handling or other well-maintained libraries.
Conclusion
The reqparser package has been compromised, leading to a serious vulnerability that can result in data exfiltration and malware installation. It is essential for users to uninstall the affected versions and seek alternatives to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for reqparser →
FAQ
The reqparser package is a Python library used for parsing request data in web applications, simplifying the handling of incoming data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
If you have installed versions 1.0.0 or 1.0.1 of the reqparser package, you should uninstall them immediately and install a secure version.
The risks include unauthorized access to sensitive information such as cryptocurrency wallet data and web browser data, as well as potential installation of additional malware on your system.
There is no patch for the affected versions, so the best course of action is to uninstall the vulnerable versions and install a secure alternative.
