Arbitrary Code Execution Vulnerability in Pip Software from PyPA

CVE-2018-20225

What is CVE-2018-20225?

A vulnerability has been identified in the Pip package manager, used across various Python projects. This issue arises when users utilize the --extra-index-url option, which can inadvertently lead to the installation of a malicious package version from an attackers' private index instead of the intended private package. The attack requires that the desired package is absent in the public index, allowing the adversary to upload a malicious version. Users are advised to exercise caution while using the --extra-index-url feature to ensure secure package management and prevent potential exploitation.

References