CVE-2020-5252: Safety Package Command-Line Poisoning
Summary
CVE-2020-5252: The command-line "safety" package for Python has a potential security issue. Affects safety versions < 1.8.7. Fixed in 1.8.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Safety package is a command-line tool for Python that detects security vulnerabilities in Python dependencies. It helps users identify and mitigate potential risks in their Python environments. However, the Safety package itself has a vulnerability that allows malicious code to disguise or obfuscate other malicious or non-secure packages. This vulnerability is considered low severity as it exploits existing Python conditions rather than a flaw in the Safety tool. It can occur when running Safety in an untrusted Python environment, using the same Python environment as dependencies, or installing arbitrary packages without proper verification.
Vulnerability Detail
The vulnerability in the Safety package allows malicious code to bypass the detection routines by disguising other malicious or non-secure packages. This can lead to the execution of harmful code or the installation of vulnerable dependencies. The attack takes advantage of existing Python conditions and is not a direct flaw in the Safety tool itself. To exploit this vulnerability, an attacker needs to have access to the Python environment and be able to install or manipulate packages. The impact of this vulnerability depends on the intentions of the attacker and the security measures in place to protect the Python environment.
How To Fix
Latest published version: 3.8.1 as of 23 Oct 2026
pip install --upgrade "safety==3.8.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.7
This is the first release that contains the fix.
pip install --upgrade "safety==1.8.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, following the mitigation steps mentioned in the 'how_to_fix' section can help protect against this vulnerability.
Conclusion
The Safety package for Python has a vulnerability that allows malicious code to bypass detection routines by disguising other packages. This can lead to the execution of harmful code or the installation of vulnerable dependencies. To mitigate this vulnerability, users should follow the recommended steps mentioned in the 'how_to_fix' section. Additionally, tools like Vulert can be used to monitor and alert for open-source vulnerabilities in real-time. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for safety →
FAQ
The impact of this vulnerability depends on the intentions of the attacker and the security measures in place. It can lead to the execution of malicious code or the installation of vulnerable dependencies.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The Safety package itself has a vulnerability, but it is designed to help identify and mitigate security risks in Python dependencies. By following the recommended mitigation steps and using additional tools like Vulert, you can enhance the security of your Python environment.
Exploiting this vulnerability requires access to the Python environment and the ability to install or manipulate packages. It is not a trivial task and depends on the security measures in place. However, it is important to address this vulnerability to prevent potential risks.
There are no specific instances mentioned in the provided information. However, it is always recommended to address vulnerabilities promptly to minimize the risk of exploitation.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
