CVE-2020-5252: Malicious package may avoid detection in python auditing
Summary
CVE-2020-5252: Malicious package may avoid detection in python auditing. Affects safety versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is 'safety', which is available on the Python Package Index (PyPI). Safety is a tool designed to find vulnerable packages in Python environments. It works by analyzing the dependencies of a project and checking them against a vulnerability database. However, this package is vulnerable to a specific issue that allows a malicious package to avoid detection by tools like Safety.
Vulnerability Detail
The vulnerability arises from the ability of a malicious package to insert a load-time poison pill, which prevents detection by tools like Safety. This is achieved by patching the safety library with a custom function. When the malicious package is installed, it adds a 'malicious.pth' file to the 'site-packages' directory, which gets loaded at interpreter load time and imports the 'malicious' package. The 'malicious/init.py' file then patches the safety library to avoid detection. This allows the malicious package to go undetected by Safety and potentially execute malicious code.
How To Fix
Latest published version: 3.8.1 as of 23 Oct 2026
pip install --upgrade "safety==3.8.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
pip install --upgrade "safety==1.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the 'safety' package to the fixed version as soon as possible.
Conclusion
In conclusion, the 'safety' package is vulnerable to a malicious package that can avoid detection by tools like Safety. To fix this vulnerability, it is crucial to update the 'safety' package to version 1.9.0 or later. There are no known workarounds, and it is recommended to regularly update all packages in your Python environment to ensure you have the latest security patches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for safety →
FAQ
The impact of this vulnerability is that a malicious package can go undetected by tools like Safety, potentially allowing it to execute malicious code in the Python environment.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will alert you if the vulnerability is present.
No, the only way to mitigate the risk is by updating the 'safety' package to the fixed version. It is not recommended to rely on workarounds or alternative solutions.
There are no known public exploits of this vulnerability at the moment. However, it is important to update the 'safety' package to prevent any potential exploitation.
No, this vulnerability specifically affects the 'safety' package. However, it is always recommended to keep all packages in your Python environment up to date to mitigate any potential security risks.
