What’s Vulnerable › Vulnerabilities

CVE-2023-31543

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-30 · updated 2026-06-17
• Weakness: CWE-427

Description

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.

Affected products

• Pipreqs Project Pipreqs: from 0.3.0 through 0.4.11

References

• https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe
• https://github.com/bndr/pipreqs/pull/364
• https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe
• https://github.com/bndr/pipreqs/pull/364

Get alerted when CVE-2023-31543 or the next vulnerability affects your stack