CVE-2022-21668 – Pipenv's requirements.txt parsing allows malicious index url in comments

https://notcve.org/view.php?id=CVE-2022-21668

10 Jan 2022 — pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the ... • https://github.com/sreeram281997/CVE-2022-21668-Pipenv-RCE-vulnerability • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-190: Integer Overflow or Wraparound CWE-427: Uncontrolled Search Path Element CWE-791: Incomplete Filtering of Special Elements CWE-1284: Improper Validation of Specified Quantity in Input •