CVE-2022-21668: Pipenv's requirements.txt parsing allows malicious index url in comments
Summary
CVE-2022-21668: Pipenv's requirements.txt parsing allows malicious index url in comments. Affects pipenv versions >= 2018.10.9, < 2022.1.8. Fixed in 2022.1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pipenv is a popular package management tool for Python that provides a virtual environment and dependency management system. It is commonly used to manage project dependencies and ensure reproducible builds. Pipenv utilizes a requirements.txt file to specify the project's dependencies and their versions. This vulnerability affects Pipenv versions prior to 2022.1.8.
Vulnerability Detail
The vulnerability in Pipenv's requirements.txt parsing allows an attacker to insert a specially crafted string inside a comment in the requirements file. When a victim uses pipenv to install the requirements file, the attacker can control the package index server from which the dependencies are downloaded. By serving malicious code in packages from their index server, the attacker can achieve arbitrary remote code execution on the victim's system. This can lead to severe consequences, including credential theft, resource exploitation, installation of malware, and potential pivoting to other targets. The likelihood of exploitation is low to moderate, depending on the attacker's ability to hide the malicious string within a comment and the complexity of the requirements file.
How To Fix
Latest published version: 2026.10.2 as of 23 Oct 2026
pip install --upgrade "pipenv==2026.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2022.1.8
This is the first release that contains the fix.
pip install --upgrade "pipenv==2022.1.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed version of Pipenv is the recommended solution.
Conclusion
The vulnerability in Pipenv's requirements.txt parsing can lead to severe consequences, including arbitrary remote code execution. Users are advised to update their Pipenv installation to version 2022.1.8 or later and review their requirements.txt file for any suspicious entries. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pipenv →
FAQ
Pipenv is a package management tool for Python that combines virtual environment and dependency management capabilities.
The vulnerability arises from a flaw in Pipenv's parsing of requirements.txt files, allowing an attacker to insert a malicious string within a comment.
By controlling the package index server, an attacker can serve malicious code in packages, leading to arbitrary remote code execution on the victim's system. This can result in various malicious activities, including credential theft and installation of malware.
Updating Pipenv to version 2022.1.8 or later is the recommended solution. Additionally, reviewing and validating the contents of the requirements.txt file can help identify any suspicious entries.
No, there is no known workaround for this vulnerability. Updating to the fixed version of Pipenv is the only solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for pipenv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
