CVE-2022-21668: Remote Code Execution in pipenv
Summary
CVE-2022-21668: pipenv is a Python development workflow tool. Affects pipenv across 2 version ranges.
>= 2018.10.9, < 2022.1.8
< 439782a8ae36c4762c88e43d5f0d8e563371b46f
Fixed in 439782a8ae36c4762c88e43d5f0d8e563371b46f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pipenv is a Python development workflow tool that provides a virtual environment, dependency management, and project isolation. It allows developers to specify project dependencies in a Pipfile and manage them using pipenv commands. The tool simplifies the process of setting up and managing Python projects.
Vulnerability Detail
A flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file. This can be exploited by an attacker to control the package index server used by victims who install the requirements file with pipenv. By serving malicious packages from their index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. The vulnerability arises from the execution of code in the setup.py file during the installation process when pip installs from a source distribution.
How To Fix
Latest published version: 2026.10.2 as of 23 Oct 2026
pip install --upgrade "pipenv==2026.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
439782a8ae36c4762c88e43d5f0d8e563371b46f
This is the first release that contains the fix.
pip install --upgrade "pipenv==439782a8ae36c4762c88e43d5f0d8e563371b46f"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update pipenv to the latest version as soon as possible.
Conclusion
The vulnerability in pipenv allows an attacker to execute arbitrary code on the victim's system by serving malicious packages from a controlled package index server. Users should update pipenv to version 2022.1.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pipenv →
FAQ
pipenv is a Python development workflow tool that provides virtual environment management and dependency resolution.
The vulnerability arises from a flaw in pipenv's parsing of requirements files, allowing an attacker to control the package index server used during installation.
By serving malicious packages from their index server, an attacker can trigger arbitrary remote code execution on the victim's system.
Yes, updating pipenv to version 2022.1.8 or later will fix this vulnerability.
There are no known workarounds. It is recommended to update pipenv to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for pipenv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
