Critical Malicious Code Vulnerability in change-user-agent Package
Summary
MAL-2025-41638: Malicious code in change-user-agent (PyPI). Affects change-user-agent versions 5.31.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The change-user-agent package is a Python library available on PyPI that allows developers to modify the User-Agent string in HTTP requests. This functionality is often used in web scraping and API interactions. However, the package has been found to contain malicious code that can compromise user systems, making it essential for users to be aware of this vulnerability.
Vulnerability Detail
The vulnerability originates from a malicious code injection in version 5.31.6 of the change-user-agent package. This code can potentially allow attackers to execute arbitrary commands on the user's machine, leading to data breaches or unauthorized access. The malicious code was identified by ReversingLabs, highlighting the importance of scrutinizing third-party packages for security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall change-user-agentIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the change-user-agent package until a secure version is confirmed. Alternatively, consider using other libraries that provide similar functionality without known vulnerabilities.
Conclusion
The change-user-agent package has a critical vulnerability due to malicious code that can compromise user systems. It is crucial for users to update to a safe version and consider alternative libraries to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can enhance security.
See every vulnerability recorded for change-user-agent →
FAQ
It is a Python library that allows modification of the User-Agent string in HTTP requests, commonly used in web scraping.
The vulnerability involves malicious code that can execute arbitrary commands on the user's machine, posing significant security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without signing up.
Immediately update the package to the latest version using the command: pip install --upgrade change-user-agent.
Yes, consider using other libraries that provide similar functionality without the known vulnerabilities.
