{"action":"Upgrade pipenv to 2022.1.8 or later.","affected":[{"fixed":"2022.1.8","introduced":"2018.10.9"}],"component":"pipenv","cve_ids":["CVE-2022-21668"],"ecosystem":"PyPI","epss":0.03807,"exploited":false,"fixed_versions":["2022.1.8"],"ghsa_id":"GHSA-qc9x-gjcv-465w","id":"tcs_01M5KFVV8BBZ7VBY99Y1499ZBC","modified_at":"2024-10-14T18:50:37.935572Z","published_at":"2022-01-12T22:29:41Z","references":["https://osv.dev/vulnerability/GHSA-qc9x-gjcv-465w","https://github.com/pypa/pipenv/security/advisories/GHSA-qc9x-gjcv-465w","https://nvd.nist.gov/vuln/detail/CVE-2022-21668","https://github.com/pypa/pipenv/commit/439782a8ae36c4762c88e43d5f0d8e563371b46f","https://github.com/pypa/advisory-database/tree/main/vulns/pipenv/PYSEC-2022-6.yaml","https://github.com/pypa/pipenv","https://github.com/pypa/pipenv/releases/tag/v2022.1.8","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56HBA3EOSLEDNCCBJVHE6DO34P56EOUM","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KCROBYHUS6DKQPCXBRPCZ5CDBNQTYAWT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHQRIWKDP3SVJABAPEXBIQPKDI6UP7G4"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-qc9x-gjcv-465w","url":"https://osv.dev/vulnerability/GHSA-qc9x-gjcv-465w"}],"summary":"Pipenv's requirements.txt parsing allows malicious index url in comments"}