Critical Malicious Code Vulnerability in requests-cache-utils Package
Summary
MAL-2026-17191: Malicious code in requests-cache-utils (PyPI). Affects requests-cache-utils versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requests-cache-utils package is a Python library available on PyPI that is designed to enhance the functionality of the requests library by providing caching capabilities. It allows developers to store responses from HTTP requests, improving performance and reducing the number of requests made to external services. However, this package has been compromised, leading to a serious security vulnerability that can affect users during installation and usage.
Vulnerability Detail
The vulnerability originates from a malicious actor who has modified the requests-cache-utils package to include harmful code. During the installation and importation of the module, the code executes an infostealer that downloads and runs a remote executable from a specified IP address. This poses significant risks, including the potential theft of sensitive information such as browser data, which can lead to further exploitation of affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall requests-cache-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the requests-cache-utils package altogether until a secure version is released. Additionally, consider using alternative libraries that provide similar caching functionalities without the associated risks.
Conclusion
The requests-cache-utils package has been compromised, leading to a critical vulnerability that can result in the theft of sensitive information. Users are advised to uninstall the package and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications effectively.
See every vulnerability recorded for requests-cache-utils →
FAQ
The vulnerability involves the execution of malicious code that downloads an infostealer during the installation of the package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Uninstall the package immediately using 'pip uninstall requests-cache-utils' and refrain from using it until a secure version is released.
Yes, consider using other caching libraries compatible with the requests library that do not have known vulnerabilities.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock, making it easier to stay informed.
