CVE-2023-5752: Vulnerability in pip Package
Summary
CVE-2023-5752: When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "-... Affects pip versions < 23.3. Fixed in 23.3. How to fix ↓
Also tracked for
- pip · Bitnami
- python-pip · Debian:11
The same CVE-2023-5752 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pip package is a popular package manager for the Python programming language. It allows users to easily install, upgrade, and manage Python packages. Pip is widely used in the Python ecosystem and is a critical component for developers and system administrators. However, prior to version 23.3, pip was vulnerable to a security issue when installing packages from a Mercurial VCS URL. This vulnerability allowed an attacker to inject arbitrary configuration options to the 'hg clone' call, potentially leading to unauthorized modifications of the repository being installed. It is important to note that this vulnerability only affects users who are installing packages from Mercurial.
Vulnerability Detail
The vulnerability (CVE-2023-5752) in the pip package arises from the ability to inject arbitrary configuration options during the installation of packages from a Mercurial VCS URL. By specifying a malicious Mercurial revision, an attacker could manipulate the 'hg clone' call and modify the repository being installed. This could result in unauthorized changes to the repository and potentially compromise the integrity of the installed package. It is crucial to update to pip version 23.3 or later to mitigate this vulnerability.
How To Fix
Latest published version: 26.2.2 as of 22 Oct 2026
pip install --upgrade "pip==26.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
23.3
This is the first release that contains the fix.
pip install --upgrade "pip==23.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update pip to the latest version to ensure the security of the package manager.
Conclusion
In conclusion, the pip package prior to version 23.3 is vulnerable to a security issue when installing packages from Mercurial. This vulnerability allows an attacker to inject arbitrary configuration options and modify the repository being installed. To mitigate this vulnerability, it is crucial to update pip to version 23.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pip →
FAQ
This vulnerability affects users who are installing packages from Mercurial using pip prior to version 23.3.
The impact of this vulnerability is that an attacker could modify the repository being installed, potentially compromising the integrity of the package.
No, this vulnerability only affects users who are installing packages from Mercurial.
Yes, updating pip to version 23.3 or later fixes this vulnerability.
No, there is no known workaround for this vulnerability. Updating pip is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for pip.
