CVE-2022-41387 - The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party

Back Back to CVE browser

CRITICAL

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party

Published Oct 11, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.29%

Description

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (3)

https://github.com/democritus-project/d8s-pdfs/issues/7
ExploitIssue TrackingThird Party Advisory
https://pypi.org/project/d8s-pdfs/
ProductThird Party Advisory
https://pypi.org/project/democritus-urls/
ProductThird Party Advisory

Link	Providers	Tags
https://github.com/democritus-project/d8s-pdfs/issues/7		ExploitIssue TrackingThird Party Advisory
https://pypi.org/project/d8s-pdfs/		ProductThird Party Advisory
https://pypi.org/project/democritus-urls/		ProductThird Party Advisory