Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pypa/pipenv
main @ fbce7b4
7
Fixes
1
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Information Disclosure: 3 prior fixes. Scrutinize any change in this area.
pipenv: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Dependency Confusion: Attackers can hijack package installations by registering malicious packages on public registries if local pip.conf configuration overrides are not strictly neutralized during subprocess execution. Under certain configurations, this can lead to remote code execution.
Path Traversal: Maliciously crafted wheel files containing relative path escape characters or path separators in script entry points can write executable scripts outside the target directory, leading to arbitrary code execution during installation.
Information Disclosure: Environment variables representing secret tokens (e.g., GITHUB_TOKEN) embedded in VCS repository source URLs can be expanded and persisted in plaintext directly within the shared 'Pipfile.lock' file, leaking them to untrusted users or public version control.