CVE Feed

    Dashboard / CVE / CVE-2023-5752

    CVE-2023-5752

    When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

    Published:Oct 24, 2023
    Last Modified:Nov 3, 2025
    EPS:Oct 24, 2023
    EPSS Score:0.00089
    CVSS Score:5.5

    Affected Products

    Vendor
    Pypa
    Product
    Pip
    Vendor
    Redhat
    Product
    Ansible Automation Platform

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-13346 (CVSS 5.6) — pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to ar…
    CVE-2026-8643 (CVSS 4.1) — pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved…
    CVE-2026-6357 (CVSS 5.3) — pip prior to version 26.1 would run self-update check functionality after installing wheel files which require…
    CVE-2021-3572 (CVSS 5.7) — A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker c…
    CVE-2018-20225 (CVSS 7.8) — An issue was discovered in pip (all versions) because it installs the version with the highest version number,…
    CVE-2019-20916 (CVSS 7.5) — The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, b…
    CVE-2014-8991 (CVSS 2.1) — pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by …
    CVE-2013-1888 (CVSS 2.1) — pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-…
    CVE-2013-1629 (CVSS 6.8) — pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks …
    CVE-2013-5123 (CVSS 5.9) — The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity…

    References

    https://github.com/pypa/pip/pull/12306
    https://lists.fedoraproject.org/archives/list/[email protected]/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/
    https://mail.python.org/archives/list/[email protected]/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/
    https://github.com/pypa/pip/pull/12306
    https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html
    https://lists.fedoraproject.org/archives/list/[email protected]/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/
    https://mail.python.org/archives/list/[email protected]/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High