PyPI/vcspull CVE-2022-21187: high 8.1, EPSS 3.62%

Command injection in libvcs and vcspull

Action: Upgrade vcspull to 1.11.1 or later.

pip install vcspull==1.11.1

Affected

Fixed versions

Sources

• osv: GHSA-mv2w-4jqc-6fg4#PyPI/vcspull
• https://nvd.nist.gov/vuln/detail/CVE-2022-21187
• https://github.com/vcs-python/libvcs/pull/306
• https://github.com/vcs-python/vcspull/commit/e1b77128a1fa0754625b5f43d8bc47956f21f33e
• https://github.com/pypa/advisory-database/tree/main/vulns/libvcs/PYSEC-2022-163.yaml
• https://github.com/vcs-python/libvcs/blob/master/CHANGES#libvcs-0111-2022-03-12
• https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12
• https://github.com/vcs-python/vcspull/blob/master/CHANGES#vcspull-1111-2022-03-12
• https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204

CVE-2022-21187 · published 2022-03-15T00:00:53Z · modified 2026-06-29T12:26:21.761856147Z · JSON